Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru Vyřešeno

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

N0váček
Level 2
Level 2
Příspěvky: 165
Registrován: prosinec 14
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod N0váček » 19 kvě 2025 14:40

Zoek:

Zoek.exe v5.0.0.2 Updated 03-May-2018(Online Version)
Tool run by david on 19.05.2025 at 14:04:58,40.
Microsoft Windows 10 Pro 10.0.19045 x64
Running in: Normal Mode Internet Access Detected
Launched: D:\anime\programy proti virům\zoek (1).exe [Scan all users] [Script inserted]

==== System Restore Info ======================

19.05.2025 14:07:53 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~3\enlisted deleted successfully
C:\Users\david\AppData\Roaming\AVG deleted successfully
C:\Users\david\AppData\Local\Black_Tree_Gaming deleted successfully
C:\Users\david\AppData\Local\gtk-3.0 deleted successfully
C:\Users\david\AppData\Local\PeerDistRepub deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NativePushService deleted successfully

==== Deleting Files \ Folders ======================

C:\Users\david\AppData\Roaming\.technic deleted
C:\Users\david\AppData\Roaming\Any Video Converter deleted
C:\Users\david\AppData\Roaming\Code deleted
C:\Users\david\AppData\Roaming\Descript deleted
C:\Users\david\AppData\Roaming\Star Stable Online deleted
C:\Users\david\AppData\Roaming\T2GP Launcher deleted
C:\Users\david\AppData\Roaming\UnofficialCrusaderPatch3 deleted
C:\Users\david\AppData\Roaming\Visual Studio Setup deleted
C:\Users\david\AppData\Roaming\Vortex deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\david\AppData\Local\krita-sysinfo.log deleted
C:\Users\david\AppData\Local\krita.log deleted
C:\Users\david\AppData\Local\oobelibMkey.log deleted
C:\Users\david\AppData\Local\cache deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147db8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147dba.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147dcb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147dcd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147dcf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147dd1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147de3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147de5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147de7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147de9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147dfb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147e1c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147e3d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147e4f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147e60.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147e72.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147e74.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147e86.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10c-2da4-147e88.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b6f4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b706.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b717.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b729.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b73a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b74c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b75e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b76f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b781.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b793.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b795.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b7b6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b7b8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b7c9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b7db.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b7dd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b7df.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b7f1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-10e0-58c-22b812.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647a24.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647a35.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647a57.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647a78.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647a99.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647a9b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647aad.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647abe.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647ae0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647af1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647b03.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647b15.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647b17.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647b28.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647b49.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647b5b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647b8c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647bad.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-114-3f1c-4647bde.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-30065d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-30066e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-3006ce.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-3006ef.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300720.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300751.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300792.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-3007f1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300803.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300815.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300817.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300838.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-30084a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-30085b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-30086d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-30086f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300890.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-30090f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12e0-2c54-300940.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f7ad.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f7af.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f7d0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f7f1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f7f3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f805.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f807.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f828.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f849.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f84b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f86c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f87e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f890.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f8a1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f8a3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f8a5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f8a7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f8b9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1430-dd8-24f8da.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cd27.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cd29.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cd4b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cd6c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cd7e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cd8f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cda1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cdb2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cdb4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cdb6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cdc8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cde9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30ce59.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30ce8a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30ce9b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cebc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cece.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30ceef.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1894-1214-30cf01.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e96a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e97c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e97e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e980.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e982.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e993.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e995.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e997.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e999.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9ab.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9ad.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9af.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9c1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9c3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9c5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9d6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9e8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9ea.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-18d8-45d0-75e9ec.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e6165.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e6186.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e61d6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e6217.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e6229.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e624a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e628a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e62ac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e6359.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e639a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e63cb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e6459.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e646b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e64ac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e64bd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e64cf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e651f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e656f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1950-35f0-1e6581.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c5d3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c623.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c654.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c685.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c6a6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c6b8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c6d9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c70a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c72b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c75c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c76e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c77f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c7a0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c7e1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c7f3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c814.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c825.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c866.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1db0-2258-16c8c6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a87f0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a87f2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8804.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8806.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8817.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8819.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a881b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a881d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a882f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8841.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8881.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8893.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8895.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a8897.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a88a8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a88aa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a88ac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a88be.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1de0-f1c-3a88c0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f49fb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a4b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a5d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a5f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a61.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a63.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a65.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a76.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a78.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a7a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a7c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a7e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4a90.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4aa2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4aa4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4aa6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4aa8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4aaa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1eb0-544-6f4aac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-2706e5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-2706f7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-2706f9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-27071a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-27071c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-27072e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-270730.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-270732.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-270763.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-270794.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-270796.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-2707a7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-2707b9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-2707bb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-2707dc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-2707ee.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-27081f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-270830.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-22ac-29c8-270842.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272376.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-2723e5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-2723e7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-2723e9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-2723eb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-2723ed.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-2723ff.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272401.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272403.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272405.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272416.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272418.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-27241a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-27241c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-27241e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272430.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272432.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272463.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-239c-f28-272494.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174ab3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174ac4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174ad6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174ae7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174ae9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174aeb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174aed.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174aff.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b01.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b03.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b05.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b07.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b19.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b1b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b1d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b1f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b30.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b32.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2454-3aa0-174b34.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-14395d2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-14395d4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-14395d6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-14395d8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-14395e9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-14395fb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-14395fd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-14395ff.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-1439601.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-1439613.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-1439624.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-1439626.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-1439628.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-143962a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-143963c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-143964e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-1439650.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-1439661.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2654-2fd0-1439673.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d4769.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d476b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d477c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d478e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d47a0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d47b1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d47c3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d47c5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d47d7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d47f8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d4809.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d480b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d481d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d481f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d4831.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d4842.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d4844.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d4856.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2670-714-8d4858.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-192109.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-19210b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-19210d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-19211e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-192120.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-192122.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-192124.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-192136.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-192138.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-19213a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-19213c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-19214e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-19215f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-192171.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-1921a2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-1921c3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-1921d5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-1921f6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2968-28c0-192217.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1962fb2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1962fc3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1962fd5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1962fd7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1962fd9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1962fea.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1962fec.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-196300e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-196301f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1963031.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1963033.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1963045.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1963047.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1963058.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-196305a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-196306c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-196306e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-196307f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-29f0-438-1963091.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae79b3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae79c5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae79d7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae79f8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a09.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a0b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a0d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a0f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a21.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a33.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a44.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a46.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a68.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a79.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a8b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a9c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7a9e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7ac0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2ba0-3e60-ae7ae1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698a8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698aa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698bc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698be.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698c0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698d2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698d4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698d6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698d8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698da.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698eb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698ed.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-17698ef.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-1769901.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-1769903.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-1769905.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-1769907.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-1769918.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2cac-1a50-176991a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-624259.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-62426b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-62427c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-62429e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-6242de.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-6242f0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-6242f2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-6242f4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-6242f6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-624317.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-624329.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-62433a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-62433c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-62434e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-624350.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-624371.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-624383.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-624394.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f58-3118-6243a6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-98762.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-98773.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-98775.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-98787.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-98789.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-9878b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-9878d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-9879f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987a1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987b2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987b4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987b6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987b8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987ba.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987cc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987ce.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987d0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987d2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-2f8c-16dc-987e4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f777.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f788.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f78a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f78c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f79e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7a0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7a2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7b3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7d5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7e6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7e8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7fa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7fc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f7fe.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f810.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f812.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f823.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f825.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-349c-47d4-4c9f827.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28a0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28a2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28a4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28b5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28b7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28b9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28cb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28cd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28df.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e28f0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e2902.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e2923.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e2925.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e2937.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e2939.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e294a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e294c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e296e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-37c4-2dc0-e297f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec33a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec34b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec34d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec34f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec351.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec363.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec375.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec377.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec379.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec37b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec38c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec38e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec390.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec392.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec394.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec3a6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec3a8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec3aa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3934-3848-ec3bc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824d9e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824daf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824db1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824dd3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e23.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e34.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e56.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e58.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e69.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e6b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e6d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e6f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e81.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e83.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e85.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e97.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824e99.tmp deleted

Reklama
N0váček
Level 2
Level 2
Příspěvky: 165
Registrován: prosinec 14
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod N0váček » 19 kvě 2025 14:40

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824eaa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3aec-48fc-2824eac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-429288.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-4292d8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-429309.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-42934a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-42934c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-4293bb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-42940b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-42941d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-42945d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-42946f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-429480.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-4294d1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-429511.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-429523.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-4295b1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-4295c3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-429623.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-429673.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3b70-530c-4296e2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0731.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0742.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0744.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0746.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0758.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0769.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a076b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a077d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a077f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0781.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0793.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0795.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a0797.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a07a8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a07aa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a07ac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a07ae.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a07c0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3c88-fdc-a07c2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbf6c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbf6e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbf80.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbf92.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbfa3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbfb5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbfc6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbfd8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cbff9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc01b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc02c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc03e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc04f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc061.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc082.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc0a4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc0b5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc115.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3ca4-3390-8cc136.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e0925b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e0925d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e0925f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e09271.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e09273.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e09275.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e09287.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e09289.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e0928b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092ac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092ae.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092b0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092c2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092c4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092d5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092d7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092d9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092eb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4054-1f58-1e092ed.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-55900b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-55900d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-55900f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559021.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559023.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559025.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559046.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559067.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559079.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-55907b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-55908c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-5590ae.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-5590bf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-5590e0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559102.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559113.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559135.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559156.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-40b8-1e58-559158.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-3878ed8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38790be.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38790d0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38790e1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38790e3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38790f5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-3879155.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38792ae.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38792d0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-387933f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38794b8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38794ca.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38794db.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38794ed.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38794ef.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-3879510.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-3879522.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-3879572.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4290-1fb4-38796db.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad679.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad6aa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad6db.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad71b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad7f8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad829.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad82b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad83c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad84e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad850.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad862.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad883.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad894.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad8a6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad8b8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad8c9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad8cb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad8cd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4300-47c0-43ad8cf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a60037.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a60097.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a600d8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a60109.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a6010b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a6018a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a60257.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a60278.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a60299.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a602da.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a6030b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a6033b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a603ab.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a603eb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a603fd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a6041e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a6043f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a60480.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-44b4-2f3c-1a60492.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-2564ed.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-25655d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-25659d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-2565be.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-25660f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-25663f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-256651.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-256692.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-2566e2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-256703.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-256734.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-256755.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-256767.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-256788.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-2567b9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-2567da.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-2567fb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-25683c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-462c-3ec8-25685d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-3525a4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-352691.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-3526c2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-3526e3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-3526f4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-352793.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-3527c4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-3527f4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-352806.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-352818.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-352839.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-35285a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-35285c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-35286e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-352870.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-352881.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-3528b2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-3528c4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4758-44a4-352914.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e798.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7aa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7bc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7be.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7cf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7d1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7d3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7e5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7e7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7e9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7eb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7fc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e7fe.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e810.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e822.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e824.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e826.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e847.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-47c0-445c-15e849.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-41853f0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-41853f2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-41853f4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-4185406.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-4185417.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-4185429.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-418542b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-418542d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-418542f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-4185441.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-4185452.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-4185454.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-4185466.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-4185468.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-418547a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-418547c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-418547e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-418548f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-4848-2e20-41854a1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dbac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dbae.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dbcf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dbd1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dbd3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dbe4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dbe6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dbe8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc0a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc0c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc0e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc10.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc12.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc23.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc25.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc27.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc29.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc4b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-578-48b8-235dc4d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c0015.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c0046.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c0057.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c0059.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c008a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c00ab.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c00bd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c00de.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c010f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c0121.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c0142.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c0173.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c0194.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c01a6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c01d7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c01e8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c01fa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c020b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-8d8-2d38-1c021d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c9796.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97a8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97aa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97bb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97bd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97bf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97d1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97d3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97d5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97e7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97f8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97fa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c97fc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c980e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c9820.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c9822.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c9833.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c9845.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-cd8-4798-3c9847.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3dafec4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3dafee5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3dafee7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3dafee9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3dafefb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3dafefd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3daff0f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db023d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db02fb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db036a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db03d9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db040a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db044b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db049b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db0558.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db057a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db0628.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db0649.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-f64-1a40-3db067a.tmp deleted
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\oobelibMkey.log deleted
"C:\Users\david\AppData\Local\kdeglobals" deleted
"C:\Users\david\AppData\Local\kdenlive-layoutsrc" deleted
"C:\Users\david\AppData\Local\kdenliverc" deleted
"C:\Users\david\AppData\Local\kritadisplayrc" deleted
"C:\Users\david\AppData\Local\kritarc" deleted
"C:\Users\david\AppData\Local\_LOCAL_GUID" deleted
"C:\DumpStack.log.tmp" not deleted
"C:\Users\david\AppData\Roaming\discord\DIPS" not deleted
"C:\Users\david\AppData\Roaming\discord\DIPS-shm" not deleted
"C:\Users\david\AppData\Roaming\discord\DIPS-wal" not deleted
"C:\Users\david\AppData\Roaming\discord\lockfile" not deleted
"C:\Users\david\AppData\Roaming\discord\SharedStorage" not deleted
"C:\Users\david\AppData\Roaming\discord\SharedStorage-wal" not deleted
"C:\Users\david\AppData\Roaming\discord\DawnGraphiteCache\data_0" deleted
"C:\Users\david\AppData\Roaming\discord\DawnGraphiteCache\data_1" deleted
"C:\Users\david\AppData\Roaming\discord\DawnGraphiteCache\data_2" deleted
"C:\Users\david\AppData\Roaming\discord\DawnGraphiteCache\data_3" deleted
"C:\Users\david\AppData\Roaming\discord\DawnGraphiteCache\index" deleted
"C:\Users\david\AppData\Roaming\discord\DawnWebGPUCache\data_0" deleted
"C:\Users\david\AppData\Roaming\discord\DawnWebGPUCache\data_1" deleted
"C:\Users\david\AppData\Roaming\discord\DawnWebGPUCache\data_2" deleted
"C:\Users\david\AppData\Roaming\discord\DawnWebGPUCache\data_3" deleted
"C:\Users\david\AppData\Roaming\discord\DawnWebGPUCache\index" deleted
"C:\Users\david\AppData\Roaming\discord\GPUCache\data_0" deleted
"C:\Users\david\AppData\Roaming\discord\GPUCache\data_1" deleted
"C:\Users\david\AppData\Roaming\discord\GPUCache\data_2" deleted
"C:\Users\david\AppData\Roaming\discord\GPUCache\data_3" deleted
"C:\Users\david\AppData\Roaming\discord\GPUCache\index" deleted
"C:\Users\david\AppData\Roaming\discord\logs\discord-webrtc_0" not deleted
"C:\Users\david\AppData\Roaming\discord\logs\discord_krisp.log" not deleted
"C:\Users\david\AppData\Roaming\discord\logs\discord_media_rCURRENT.log" not deleted
"C:\Users\david\AppData\Roaming\discord\logs\Discord_updater_rCURRENT.log" not deleted
"C:\Users\david\AppData\Roaming\discord\logs\discord_utils.log" not deleted
"C:\Users\david\AppData\Roaming\discord\Network\Cookies" not deleted
"C:\Users\david\AppData\Roaming\discord\Network\Cookies-journal" not deleted
"C:\Users\david\AppData\Roaming\discord\Network\Trust Tokens" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage\000005.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage\000008.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage\000010.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage\000013.log" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage\000014.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage\LOCK" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage\LOG" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage\MANIFEST-000001" not deleted
"C:\Users\david\AppData\Roaming\discord\Shared Dictionary\db" not deleted
"C:\Users\david\AppData\Roaming\discord\WebStorage\QuotaManager" not deleted
"C:\Users\david\AppData\Roaming\discord\WebStorage\QuotaManager-journal" not deleted
"C:\Users\david\AppData\Roaming\discord\Cache\Cache_Data\data_0" deleted
"C:\Users\david\AppData\Roaming\discord\Cache\Cache_Data\data_1" deleted
"C:\Users\david\AppData\Roaming\discord\Cache\Cache_Data\data_2" deleted
"C:\Users\david\AppData\Roaming\discord\Cache\Cache_Data\data_3" deleted
"C:\Users\david\AppData\Roaming\discord\Cache\Cache_Data\index" deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\000005.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015195.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015196.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015199.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015200.log" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015201.ldb" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\LOCK" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\LOG" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001" not deleted
"C:\Users\david\AppData\Roaming\discord\module_data\crashlogs\4_12_2025__11_07_58_PM_GMT_2-0-events.log" not deleted
"C:\Users\david\AppData\Roaming\discord" not deleted
"C:\Users\david\AppData\Roaming\discord\Cache" not deleted
"C:\Users\david\AppData\Roaming\discord\DawnGraphiteCache" not deleted
"C:\Users\david\AppData\Roaming\discord\DawnWebGPUCache" not deleted
"C:\Users\david\AppData\Roaming\discord\GPUCache" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage" not deleted
"C:\Users\david\AppData\Roaming\discord\logs" not deleted
"C:\Users\david\AppData\Roaming\discord\module_data" not deleted
"C:\Users\david\AppData\Roaming\discord\Network" not deleted
"C:\Users\david\AppData\Roaming\discord\Session Storage" not deleted
"C:\Users\david\AppData\Roaming\discord\Shared Dictionary" not deleted
"C:\Users\david\AppData\Roaming\discord\WebStorage" not deleted
"C:\Users\david\AppData\Roaming\discord\Cache\Cache_Data" not deleted
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb" not deleted
"C:\Users\david\AppData\Roaming\discord\module_data\crashlogs" not deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"web2pdfextension.17@acrobat.adobe.com"="D:\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi" [23.07.2021 23:39]
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"web2pdfextension.17@acrobat.adobe.com"="D:\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi" [23.07.2021 23:39]

==== Firefox XPI-files found: ======================

- Undetermined - C:\Program Files\Adobe\Adobe Media Encoder 2025\PlugIns\XMPFiles\MXFHandler.xpi
- Undetermined - C:\Program Files\Adobe\Adobe Media Encoder 2025\PlugIns\XMPFiles\REDHandler.xpi

==== Chromium Look ======================

Google Chrome Version: 136.0.7103.114

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
efaidnbmnnnibpcajpcglclefindmkaj - No path found[]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
efaidnbmnnnibpcajpcglclefindmkaj - No path found[]

uBlockâ‚€ - david\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm
ChatGPT search - david\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\ejcfepkfckglbgocfkanmcdngdijcgld
Edge relevant text changes - david\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02

==== Reset Google Chrome ======================

C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Preferences was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Secure Preferences was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\System Profile\Preferences was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\System Profile\Secure Preferences was reset successfully
C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Preferences was reset successfully
C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data-journal was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Web Data was reset successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Web Data-journal was reset successfully
C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Web Data will be reset at reboot
C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lotrbfme.exe deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lotrbfme2.exe deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lotrbfme2ep1.exe deleted successfully

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\david\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\david\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\Users\david\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\david\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\david\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\david\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\david\AppData\Local\Google\Chrome\User Data\Guest Profile\Cache emptied successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Cache emptied successfully
C:\Users\david\AppData\Local\Google\Chrome\User Data\System Profile\Cache emptied successfully
C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Cache will be emptied at reboot

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=8690 folders=2382 7958925244 bytes)

==== Empty Temp Folders ======================

C:\Users\david\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\defaultuser100000\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\david\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\DumpStack.log.tmp" not deleted
"C:\Users\david\AppData\Roaming\discord\DIPS" not found
"C:\Users\david\AppData\Roaming\discord\DIPS-shm" not found
"C:\Users\david\AppData\Roaming\discord\DIPS-wal" not found
"C:\Users\david\AppData\Roaming\discord\lockfile" not found
"C:\Users\david\AppData\Roaming\discord\SharedStorage" not found
"C:\Users\david\AppData\Roaming\discord\SharedStorage-wal" not found
"C:\Users\david\AppData\Roaming\discord\logs\discord-webrtc_0" not found
"C:\Users\david\AppData\Roaming\discord\logs\discord_krisp.log" not found
"C:\Users\david\AppData\Roaming\discord\logs\discord_media_rCURRENT.log" not found
"C:\Users\david\AppData\Roaming\discord\logs\Discord_updater_rCURRENT.log" not found
"C:\Users\david\AppData\Roaming\discord\logs\discord_utils.log" not found
"C:\Users\david\AppData\Roaming\discord\Network\Cookies" not found
"C:\Users\david\AppData\Roaming\discord\Network\Cookies-journal" not found
"C:\Users\david\AppData\Roaming\discord\Network\Trust Tokens" not found
"C:\Users\david\AppData\Roaming\discord\Session Storage\000005.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Session Storage\000008.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Session Storage\000010.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Session Storage\000013.log" not found
"C:\Users\david\AppData\Roaming\discord\Session Storage\000014.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Session Storage\LOCK" not found
"C:\Users\david\AppData\Roaming\discord\Session Storage\LOG" not found
"C:\Users\david\AppData\Roaming\discord\Session Storage\MANIFEST-000001" not found
"C:\Users\david\AppData\Roaming\discord\Shared Dictionary\db" not found
"C:\Users\david\AppData\Roaming\discord\WebStorage\QuotaManager" not found
"C:\Users\david\AppData\Roaming\discord\WebStorage\QuotaManager-journal" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\000005.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015195.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015196.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015199.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015200.log" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\015201.ldb" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\LOCK" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\LOG" not found
"C:\Users\david\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001" not found
"C:\Users\david\AppData\Roaming\discord\module_data\crashlogs\4_12_2025__11_07_58_PM_GMT_2-0-events.log" not found
"C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" not found
"C:\Users\david\AppData\Roaming\discord" not found
"C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data" deleted

==== EOF on 19.05.2025 at 14:27:31,49 ======================

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43287
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod jaro3 » 19 kvě 2025 16:10

Ještě Zemana.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

N0váček
Level 2
Level 2
Příspěvky: 165
Registrován: prosinec 14
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod N0váček » 20 kvě 2025 15:05

Informace o kontroly
Název produktu    :  Zemana AntiMalware
Stav kontroly    :  Dokončena
Datum kontroly    :  20.05.2025 15:04:33
Typ kontroly    :  Inteligentní kontrola
Čas trvání    :  00:00:37
Zkontrolované objekty    :  2362
Zjištěné objekty    :  0
Vyloučené objekty    :  0
Automatické odesílání    :  Ne
Operační systém    :  Windows 10 x64
Procesor    :  6X Intel(R) Core(TM) i5-8600K CPU @ 3.60GHz
Režim systému BIOS    :  UEFI
Informace o doméně    :  WORKGROUP,False,NetSetupWorkgroupName
CUID    :  14FA32A0D74BA77B9CAE60

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43287
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod jaro3 » 20 kvě 2025 15:33

Vypni antivir i firewall.
Prosím stáhni příslušnou verzi programu pro Tvůj systém 32-bit/64-bit FarbarRecovery Scan Tool (FrSt)
32bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/81/
64bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/82/
další odkaz:
http://www.bleepingcomputer.com/downloa ... scan-tool/
a ulož jej na plochu. ,pak spusť FrSt.
Potvrď způsob užití.
Neměň žádné z výchozích nastavení a klikni na položku „Scan“ („Skenovat“) .Když je skenování dokončeno, ukážou se dva logy = FRST.txt a Addition.txt a uloží se na ploše.Prosím zkopíruj sem celý jejich obsah.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

N0váček
Level 2
Level 2
Příspěvky: 165
Registrován: prosinec 14
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod N0váček » 20 kvě 2025 21:27

Addition log:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-05-2025
Ran by david (20-05-2025 21:23:58)
Running from C:\Users\david\Desktop
Microsoft Windows 10 Pro Version 22H2 19045.5854 (X64) (2020-09-17 23:21:41)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-2321539691-1916493358-1505984254-500 - Administrator - Disabled)
david (S-1-5-21-2321539691-1916493358-1505984254-1001 - Administrator - Enabled) => C:\Users\david
DefaultAccount (S-1-5-21-2321539691-1916493358-1505984254-503 - Limited - Disabled)
Guest (S-1-5-21-2321539691-1916493358-1505984254-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-2321539691-1916493358-1505984254-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 24.08 (x64) (HKLM\...\7-Zip) (Version: 24.08 - Igor Pavlov)
Activision(R) (HKLM-x32\...\{3FAD68D9-1FA1-4871-9ADF-9151D969E943}) (Version: 1.00.0000 - Activision) Hidden
Adobe Acrobat (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-0C0F074E4100}) (Version: 25.001.20474 - Adobe Systems Incorporated)
Adobe Bridge 2025 (HKLM-x32\...\KBRG_15_0_2) (Version: 15.0.2 - Adobe Inc.)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 6.6.0.611 - Adobe Inc.)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Genuine Service (HKLM-x32\...\AdobeGenuineService) (Version: 8.6.0.79 - Adobe Inc.)
Adobe Illustrator 2025 (HKLM-x32\...\ILST_29_3_1) (Version: 29.3.1 - Adobe Inc.)
Adobe Media Encoder 2025 (HKLM-x32\...\AME_25_1) (Version: 25.1 - Adobe Inc.)
Adobe Photoshop 2025 (HKLM-x32\...\PHSP_26_3) (Version: 26.3.0.156 - Adobe Inc.)
Adobe Refresh Manager (HKLM-x32\...\{AC76BA86-0804-1033-1959-018244601110}) (Version: 1.8.0 - Adobe Systems Incorporated) Hidden
Aliens vs. Predator 2 (HKLM-x32\...\Aliens vs. Predator 2) (Version: - AvP Unknown)
Aliens vs. Predator 2 Tools (HKLM-x32\...\{47D511E4-CF3F-45D4-90A0-B02E086A889C}) (Version: - )
Amnesia - The Dark Descent + Justine (CZ Dabing) (HKLM-x32\...\FPD_ATDD-2018_is1) (Version: 1.0 - Fénix ProDabing)
Any Video Converter 7.0.4 (HKLM-x32\...\Any Video Converter) (Version: 7.0.4 - Anvsoft)
Aplikace NVIDIA 11.0.3.241 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NvApp) (Version: 11.0.3.241 - NVIDIA Corporation)
Atomic Heart CZ (HKLM-x32\...\Atomic Heart CZ) (Version: - )
Attack of the Saucerman (HKLM-x32\...\Attack of the Saucerman) (Version: - )
Audacity 3.7.1 (HKLM\...\Audacity_is1) (Version: 3.7.1 - Audacity Team)
AviSynth 2.5 (HKLM-x32\...\Avisynth) (Version: - )
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BFME2 Ecth's Patch Switcher (HKLM-x32\...\BFME2 Ecth's Patch Switcher) (Version: v5.43 - )
Browser for SQL Server 2017 (HKLM-x32\...\{CF8EEB96-E7E7-4EF7-A0A1-559F09953156}) (Version: 14.0.1000.169 - Microsoft Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 6.34 - Piriform)
CertsUpdater version 1.5 (HKLM-x32\...\{90DE7E86-6F5A-4125-9EC5-D95093C80093}_is1) (Version: 1.5 - Saber Interactive Inc.)
Clive Barker's Undying (HKLM-x32\...\1207659191_is1) (Version: 1.1 hotfix - GOG.com)
CPUID HWMonitor 1.41 (HKLM\...\CPUID HWMonitor_is1) (Version: 1.41 - CPUID, Inc.)
CrystalDiskInfo 7.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.0.4 - Crystal Dew World)
CrystalDiskInfo 9.6.3 (64bitový) (HKLM\...\CrystalDiskInfo_is1) (Version: 9.6.3 - Crystal Dew World)
CrystalDiskMark 6.0.2 (HKLM\...\CrystalDiskMark6_is1) (Version: 6.0.2 - Crystal Dew World)
Čeština do hry South Park: Klacek Pravdy verze 1.1 (HKLM-x32\...\{C1EA3034-6A86-4C18-A91F-SPSOTCZ110FE}_is1) (Version: 1.1 - Ubisoft)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.10.0.0770 - Disc Soft Ltd)
Dawn of War - Soulstorm (HKLM-x32\...\{20533183-D42D-4261-A125-956736FBEA8C}) (Version: 1.00.0000 - THQ)
Dino Island (HKLM-x32\...\Dino Island) (Version: - )
Discord (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Discord) (Version: 1.0.9041 - Discord Inc.)
DOOM II with Master Levels (HKLM-x32\...\1435848814_is1) (Version: 2.0.0.6 - GOG.com)
EA app (HKLM\...\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}) (Version: 13.468.0.5981 - Electronic Arts) Hidden
EA app (HKLM-x32\...\{9fadc9c1-bd21-46fd-ad7e-8e08ace2687e}) (Version: 13.468.0.5981 - Electronic Arts)
Eclipse Temurin JDK with Hotspot 17.0.7+7 (x64) (HKLM\...\{2D86ADAC-D84A-4867-8172-4E425F0FF8D5}) (Version: 17.0.7.7 - Eclipse Adoptium)
Enlisted Launcher 1.0.3.138 (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\{5fcad5a5-d0d8-4edf-a5ba-040b397eac31}}_is1) (Version: - Gaijin Network)
Fallout 76 - čeština (HKLM-x32\...\{9F153C9C-19DB-4906-B2E3-DAB3B69B3215}_is1) (Version: 2022-10-03 - Naprogramuji.eu)
Fallout Mod Manager 0.13.21 (HKLM-x32\...\Generic Mod Manager_is1) (Version: - Q, Timeslip)
Fallout New Vegas - Ultimate Edition (HKLM-x32\...\Fallout New Vegas - Ultimate Edition_is1) (Version: - )
Filius 2.6.1 (HKLM-x32\...\Filius) (Version: 2.6.1 - Stefan Freischlad)
Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - )
FRAPS Cracked (HKLM-x32\...\{64C2944E-AFBD-480F-81A3-CE19B918BDD7}) (Version: 3.5.99.15618 - Beepa Pty Ltd) Hidden
FRAPS Cracked (HKLM-x32\...\FRAPS Cracked 3.5.99.15618) (Version: 3.5.99.15618 - Beepa Pty Ltd)
Git version 2.22.0.windows.1 (HKLM\...\Git_is1) (Version: 2.22.0.windows.1 - The Git Development Community)
GOG.com Heroes of Might and Magic 3 (HKLM\...\{1d3c859c-1028-4822-b0a7-da4f7bbc18bc}.sdb) (Version: - )
GOG.com Total Annihilation (HKLM\...\{45dc0305-7ff3-430c-b4b9-59e2c7600cdf}.sdb) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 136.0.7103.114 - Google LLC)
GTA San Andreas (HKLM-x32\...\{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}) (Version: 1.00.00001 - Rockstar Games)
Heroes of Might and Magic 3 Complete (HKLM-x32\...\GOGPACKHOMM3COMPLETE_is1) (Version: 2.0.0.16 - GOG.com)
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
Intel(R) C++ Redistributables on Intel(R) 64 (HKLM-x32\...\{F70BCE36-25F2-4475-A918-6209B3D85BF3}) (Version: 15.0.179 - Intel Corporation)
Java 8 Update 411 (64-bit) (HKLM\...\{77924AE4-039E-4CA4-87B4-2F64180411F0}) (Version: 8.0.4110.9 - Oracle Corporation)
Java(TM) SE Development Kit 21.0.1 (64-bit) (HKLM\...\{75B0E1AE-DC20-5AC0-A358-61B0256DADBE}) (Version: 21.0.1.0 - Oracle Corporation)
kdenlive (HKLM-x32\...\kdenlive) (Version: 24.12.2 - KDE e.V.)
KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 4.2.2.19 - PandoraTV)
Kontrola stavu osobního počítače s Windows (HKLM\...\{D1F15F7A-707A-42BD-BE6B-3380616F796D}) (Version: 3.6.2204.08001 - Microsoft Corporation)
Krita (x64) 5.2.6 (git ab3502b) (HKLM\...\Krita_x64) (Version: 5.2.6.0 - Krita Foundation)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Riot Game league_of_legends.live) (Version: - Riot Games, Inc)
LibreOffice 6.3.3.2 (HKLM\...\{4DACF7A7-C851-4943-A63D-3CAE495C48E0}) (Version: 6.3.3.2 - The Document Foundation)
Malwarebytes version 5.2.11.183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 5.2.11.183 - Malwarebytes)
Microsoft .NET Core Host - 3.1.22 (x86) (HKLM-x32\...\{DCE56968-ED20-4F21-9CA3-93D7792BFB50}) (Version: 24.88.30721 - Microsoft Corporation) Hidden
Microsoft .NET Core Host FX Resolver - 3.1.22 (x86) (HKLM-x32\...\{D41E43E5-03A3-4367-8AD6-0B510C59794E}) (Version: 24.88.30721 - Microsoft Corporation) Hidden
Microsoft .NET Core Runtime - 3.1.22 (x86) (HKLM-x32\...\{54C416DE-9495-4FFC-B2A7-E7AF82DEA8A4}) (Version: 24.88.30721 - Microsoft Corporation) Hidden
Microsoft 365 Apps pro velké organizace - cs-cz (HKLM\...\O365ProPlusRetail - cs-cz) (Version: 16.0.18730.20168 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 136.0.3240.76 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 136.0.3240.76 - Microsoft Corporation) Hidden
Microsoft Excel 2019 - cs-cz (HKLM\...\Excel2019Retail - cs-cz) (Version: 16.0.18730.20168 - Microsoft Corporation)
Microsoft GameInput (HKLM-x32\...\{1F2B6AF3-C260-8666-5950-E3FEDBC851D6}) (Version: 10.1.22621.3036 - Microsoft Corporation)
Microsoft ODBC Driver 13 for SQL Server (HKLM\...\{76CF9EF4-ABA0-484E-8042-12B99499AF5F}) (Version: 14.0.1000.169 - Microsoft Corporation)
Microsoft Office 32-bit Components 2013 (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (HKLM\...\{90150000-001F-0407-1000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (Czech) 2013 (HKLM\...\{90150000-00E1-0405-1000-0000000FF1CE}) (Version: 15.0.4454.1004 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2016 - cs-cz (HKLM\...\ProplusRetail - cs-cz) (Version: 16.0.18730.20168 - Microsoft Corporation)
Microsoft Office Professional Plus 2019 - cs-cz (HKLM\...\ProPlus2019Retail - cs-cz) (Version: 16.0.18730.20168 - Microsoft Corporation)
Microsoft Office Proofing (Czech) 2013 (HKLM\...\{90150000-002C-0405-1000-0000000FF1CE}) (Version: 15.0.4454.1004 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (HKLM\...\{90150000-001F-0409-1000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (Czech) 2013 (HKLM\...\{90150000-00C1-0405-1000-0000000FF1CE}) (Version: 15.0.4454.1004 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (Czech) 2013 (HKLM\...\{90150000-006E-0405-1000-0000000FF1CE}) (Version: 15.0.4454.1004 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\OneDriveSetup.exe) (Version: 25.075.0420.0002 - Microsoft Corporation)
Microsoft PowerPoint 2019 - cs-cz (HKLM\...\PowerPoint2019Retail - cs-cz) (Version: 16.0.18730.20168 - Microsoft Corporation)
Microsoft Project - cs-cz (HKLM\...\ProjectPro2019Retail - cs-cz) (Version: 16.0.18730.20168 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client (HKLM\...\{4D2C56FF-7F36-4B49-A97A-24F0522D41D7}) (Version: 11.3.6540.0 - Microsoft Corporation)
Microsoft SQL Server 2017 (64-bit) (HKLM\...\Microsoft SQL Server SQL2017) (Version: - Microsoft Corporation)
Microsoft SQL Server 2017 RsFx Driver (HKLM\...\{7123D29F-9197-4686-A619-C7E8EA289718}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
Microsoft SQL Server 2017 Setup (English) (HKLM\...\{405252DC-ADF7-4BC8-95F5-F89DE513DD62}) (Version: 14.0.1000.169 - Microsoft Corporation)
Microsoft SQL Server 2017 T-SQL Language Service (HKLM\...\{C8A51693-98B9-4AB1-91B8-9A1B86729D5F}) (Version: 14.0.1000.169 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{1FC1A6C2-576E-489A-9B4A-92D21F542136}) (Version: 3.74.0.0 - Microsoft Corporation)
Microsoft Visio - cs-cz (HKLM\...\VisioPro2019Retail - cs-cz) (Version: 16.0.18730.20168 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}) (Version: 11.0.61030.0 - Корпорация Майкрософт)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32\...\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664 (HKLM-x32\...\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664 (HKLM\...\{010792BA-551A-3AC0-A7EF-0FAB4156C382}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664 (HKLM\...\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664 (HKLM-x32\...\{D401961D-3A20-3AC7-943B-6139D5BD490A}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664 (HKLM-x32\...\{8122DAB1-ED4D-3676-BB0A-CA368196543E}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 (HKLM-x32\...\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}) (Version: 14.30.30704.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.32.31326 (HKLM-x32\...\{2d507699-404c-4c8b-a54a-38e352f32cdd}) (Version: 14.32.31326.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33810 (HKLM-x32\...\{5af95fd8-a22e-458f-acee-c61bd787178e}) (Version: 14.40.33810.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433 (HKLM-x32\...\{804e7d66-ccc2-4c12-84ba-476da31d103d}) (Version: 14.42.34433.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 (HKLM-x32\...\{4d8dcf8c-a72a-43e1-9833-c12724db736e}) (Version: 14.30.30704.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.32.31326 (HKLM-x32\...\{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a}) (Version: 14.32.31326.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.38.33135 (HKLM-x32\...\{46c3b171-c15c-4137-8e1d-67eeb2985b44}) (Version: 14.38.33135.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34433 (HKLM-x32\...\{e7802eac-3305-4da0-9378-e55d1ed05518}) (Version: 14.42.34433.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433 (HKLM\...\{E1902FC6-C423-4719-AB8A-AC7B2694B367}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433 (HKLM\...\{382F1166-A409-4C5B-9B1E-85ED538B8291}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34433 (HKLM-x32\...\{84E3E712-6343-484B-8B6C-9F145F019A70}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433 (HKLM-x32\...\{C2BB95AA-90F3-4891-81C1-A7E565BB836C}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual Studio Code (User) (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\{771FD6B0-FA20-440A-A002-3B3BAC16DC50}_is1) (Version: 1.100.2 - Microsoft Corporation)
Microsoft VSS Writer for SQL Server 2017 (HKLM\...\{20B328C9-C6BB-434A-928A-00F05CD820B8}) (Version: 14.0.1000.169 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 3.1.22 (x86) (HKLM-x32\...\{675abf0e-683c-414e-8b1b-9cd40aeb368b}) (Version: 3.1.22.30721 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 3.1.22 (x86) (HKLM-x32\...\{EDB662A8-AD69-44B1-B2FB-6E9BF86BA0B9}) (Version: 24.88.30721 - Microsoft Corporation) Hidden
Microsoft Word 2013 (HKLM\...\{90150000-001B-0000-1000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Word 2013 (HKLM\...\Office15.WORD) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Word 2019 - cs-cz (HKLM\...\Word2019Retail - cs-cz) (Version: 16.0.18730.20168 - Microsoft Corporation)
Microsoft Word MUI (Czech) 2013 (HKLM\...\{90150000-001B-0405-1000-0000000FF1CE}) (Version: 15.0.4454.1004 - Microsoft Corporation) Hidden
Movavi Video Editor Plus 2022 (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Movavi Video Editor Plus 2022) (Version: 22.3.0 - Movavi)
MSVCRT Redists (HKLM\...\{52116C70-79F9-11E6-9541-BB95F5A309BD}) (Version: 1.0 - MAGIX Computer Products Intl. Co.) Hidden
MSVCRT Redists (HKLM\...\{E5637EB0-7FC4-11E7-B61D-95BE57594EAC}) (Version: 1.0 - MAGIX Computer Products Intl. Co.) Hidden
MSVCRT Redists (HKLM\...\{FD01461E-5788-11EB-9E8B-00155D51A912}) (Version: 1.0 - MAGIX Computer Products Intl. Co.) Hidden
Naruto Online (HKLM-x32\...\Naruto Online) (Version: 3.4.4.0 - OASIS GAMES LIMITED)
Nástroje kontroly pravopisu pro Microsoft Office 2013 – čeština (HKLM\...\{90150000-001F-0405-1000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Nástroje korektúry balíka Microsoft Office 2013 - slovenčina (HKLM\...\{90150000-001F-041B-1000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Native Plus 1.0 (HKLM-x32\...\Native Plus 1.0) (Version: - )
Norland [K] (HKLM\...\Norland [K]_is1) (Version: 0.4176.6122.0 - K-Repack)
NVIDIA FrameView SDK 1.5.10920.35420203 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.5.10920.35420203 - NVIDIA Corporation)
NVIDIA Ovladač HD audia 1.4.3.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.4.3.2 - NVIDIA Corporation)
NVIDIA Ovladače grafiky 576.40 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 576.40 - NVIDIA Corporation)
NVIDIA Systémový software PhysX 9.23.1019 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.23.1019 - NVIDIA Corporation)
Oculus (HKLM\...\Oculus) (Version: <3 - Facebook Technologies, LLC)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.18623.20156 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.18623.20156 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.18730.20168 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0405-0000-0000000FF1CE}) (Version: 16.0.14131.20278 - Microsoft Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Ôŕđáč (HKLM-x32\...\Ôŕđáč) (Version: - )
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.275.0.13 - Overwolf Ltd.)
Paradox Launcher v2 (HKLM\...\{BCBAAF27-1C19-48A5-8DEF-258E46D93FE0}) (Version: 2.4.0 - Paradox Interactive)
Patch for BFME 1 version 1.05 (HKLM-x32\...\PATCH105_is1) (Version: 1.05 - )
Pentablet (HKLM\...\{5DAB8C1A-6D8E-467D-BE62-AC13087AA950}_is1) (Version: 4.0.4.240923 - XPPen Technology)
Penumbra - Necrologue (CZ Dabing + Texty) (HKLM-x32\...\FPD_PN_is1) (Version: 1.0 - Fénix ProDabing)
PLITCH 2.10.5 (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\{3248AA2D-83C9-4761-AEA0-D2F64D6517C3}_is1) (Version: 2.10.5 - MegaDev GmbH)
Project64 version 3.0.1.5664 (HKLM-x32\...\{BEB5FB69-4080-466F-96C4-F15DF271718B}_is1) (Version: 3.0.1.5664 - )
Python 3.7.4 (64-bit) (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\{8ae589dd-de2e-42cd-af56-102374115fee}) (Version: 3.7.4150.0 - Python Software Foundation)
Python 3.7.4 Add to Path (64-bit) (HKLM\...\{16AB56AD-A068-4407-B239-25D2A507743D}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 Core Interpreter (64-bit) (HKLM\...\{92A73F83-DC16-4316-945A-B66BC12362A7}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 Development Libraries (64-bit) (HKLM\...\{B86709C3-962E-4C62-BF25-CF8D06267D72}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 Documentation (64-bit) (HKLM\...\{4BC82D3B-BBC7-4BAF-899D-10AF5745E4AB}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 Executables (64-bit) (HKLM\...\{6DDB726E-09CE-44B4-A129-B62AD1604A95}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 pip Bootstrap (64-bit) (HKLM\...\{F92D31AF-F447-4A85-B0FD-CE6378F7625A}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 Standard Library (64-bit) (HKLM\...\{5BF79310-A787-430F-93DD-CC8A9787679D}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 Tcl/Tk Support (64-bit) (HKLM\...\{E5B772D5-8CCD-461B-BC60-B10DFB5704AB}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 Test Suite (64-bit) (HKLM\...\{794D5EC8-A92F-4969-A318-449C2E71D8C4}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Python 3.7.4 Utility Scripts (64-bit) (HKLM\...\{16F74529-EDE0-4BBD-B2AF-89AF9C696EA8}) (Version: 3.7.4150.0 - Python Software Foundation) Hidden
Quake III Gold (HKLM-x32\...\1441704920_is1) (Version: 2.0.0.2 - GOG.com)
Return to Castle Wolfenstein (CZ Dabing + texty) (HKLM-x32\...\FPD_RTCW2019_is1) (Version: 1.0 - Fénix ProDabing)
Riot Vanguard (HKLM\...\Riot Vanguard) (Version: - Riot Games, Inc.)
RoboCop: Rogue City CZ verze 1.2 (HKLM-x32\...\{52E428AE-EB3A-4CBC-A95F-CA570E549D85}}_is1) (Version: 1.2 - Luc2as)
Rockstar Games Launcher (HKLM-x32\...\Rockstar Games Launcher) (Version: 1.0.85.1858 - Rockstar Games)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 2.2.7.3 - Rockstar Games)
RogueKiller version 15.12.1.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 15.12.1.0 - Adlice Software)
Singularity (HKLM-x32\...\Singularity_is1) (Version: - Galfimbul)
Soccer Mania (HKLM-x32\...\InstallShield_{AF833FA4-6845-4668-B5EE-AF4FBDAB119D}) (Version: 0.01.0000 - LEGO Media)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.9.0 - Sophos Limited)
South Park: TFbW CZ v1.1 (HKLM-x32\...\South Park: TFbW CZ) (Version: 1.1 - Squiee)
Speccy (HKLM\...\Speccy) (Version: 1.32 - Piriform)
SQL Server 2017 Batch Parser (HKLM\...\{2C6E8311-28BD-4615-9545-6E39E8E83A4B}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Common Files (HKLM\...\{9D1C0509-D490-4E9E-ACF5-A73E5C53742D}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Common Files (HKLM\...\{B777C4C0-A1CD-4AB9-99B1-AD5FBED6F8E5}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Connection Info (HKLM\...\{89A7644F-E056-4EC1-BFDE-9D1A531D6855}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Connection Info (HKLM\...\{A9A443F5-56E1-4FC6-937C-5F481345A843}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Database Engine Services (HKLM\...\{28EEF6BA-A23A-42D2-86BA-A6BEE723B969}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Database Engine Services (HKLM\...\{DED314CA-0EFE-4593-9D66-EF75E5289A4C}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Database Engine Shared (HKLM\...\{0E22DBB4-691B-400C-B52D-8DFE8EC421AA}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Database Engine Shared (HKLM\...\{793F1C1E-5C83-4E33-A29B-6EAA7C1E791C}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 DMF (HKLM\...\{B9998A13-5563-496C-B95E-597FFC70B670}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 DMF (HKLM\...\{D7D28BBF-3B0E-43F0-A457-331F1CD9E9EB}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Shared Management Objects (HKLM\...\{10855B1A-F7F2-4D8A-A725-9287C73BED5A}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Shared Management Objects (HKLM\...\{6CBBF624-696C-499E-948D-ADBAFFA2F548}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Shared Management Objects Extensions (HKLM\...\{8C515C22-BE07-4908-985C-0AA9349E1ED4}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 Shared Management Objects Extensions (HKLM\...\{C6D92730-3EC0-47B1-8F6C-6F5635D1EFAC}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 SQL Diagnostics (HKLM\...\{DFA6A906-3024-49DE-87AD-750EAED2FA49}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 XEvent (HKLM\...\{12D2DB8D-80FF-4152-8F51-EDB3BD3C6976}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
SQL Server 2017 XEvent (HKLM\...\{AA2A015C-C210-413B-95F6-BF9D3CDD6E0D}) (Version: 14.0.1000.169 - Microsoft Corporation) Hidden
Star Stable Online 2.46.0 (HKLM\...\8c663ade-0de5-52b6-812d-f5cd25f943ac) (Version: 2.46.0 - Star Stable Entertainment AB)
StarCraft (HKLM-x32\...\Starcraft) (Version: - Blizzard Entertainment)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Stubbs the Zombie (HKLM-x32\...\InstallShield_{555ACAE5-B0D5-4E12-8F95-22757DEFAD0F}) (Version: 1.02.0000 - Název společnosti:)
SuperNova Player (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\TacticsTechnologySuperNova) (Version: - )
Synfig Studio (64bit) (HKLM\...\synfigstudio) (Version: 1.4.5-f4b8d - )
T3A Patch for BFME 1 (all-in-one) version 1.06 (HKLM-x32\...\T3APATCH106AIO_is1) (Version: 1.06 - )
T3A Patch for BFME 1 version 1.06 (HKLM-x32\...\T3APATCH106_is1) (Version: 1.06 - )
T3A:Online (HKLM-x32\...\{F4BF91D3-5D77-424C-AA61-CE7A1BCA4C63}) (Version: 2.1.3 - Revora)
TavernWorker for Dark and Darker - Steam (HKLM\...\TavernWorker for Dark and Darker - Steam) (Version: - IRONMACE)
Teams Machine-Wide Installer (HKLM-x32\...\{731F6BAA-A986-45A4-8936-7C3AAAAA760B}) (Version: 1.5.0.8070 - Microsoft Corporation)
Temp File Cleaner (HKLM\...\Temp File Cleaner) (Version: 4.5.0.74(master)(8d92a0e96285c09fa03691e2b7618aee84c6c2b6) - Addpcs, LLC)
The Battle for Middle-earth (tm) (HKLM-x32\...\{3F290582-3F4E-4B96-009C-E0BABAA40C42}) (Version: - )
The Battle for Middle-earth (tm) II (HKLM-x32\...\{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}) (Version: - )
The Sims 3 (HKLM-x32\...\The Sims 3_is1) (Version: - )
The Sims™ 3 Кино Каталог (HKLM-x32\...\{D0087539-3C57-44E0-BEE7-D779D546CBE1}) (Version: 20.0.53 - Electronic Arts)
The Walking Dead: Saints & Sinners CZ (HKLM-x32\...\The Walking Dead: Saints & Sinners CZ) (Version: - )
Theme Hospital (HKLM-x32\...\Theme Hospital_is1) (Version: - GOG.com)
Thunderstore Mod Manager (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Overwolf_ahpflogoookodlegojjphcjpjaejgghjnfcdjdmi) (Version: 1.69.0 - Overwolf app)
Total Annihilation Commander Pack (HKLM-x32\...\1207658880_is1) (Version: 3.1 - GOG.com)
Ubisoft Connect (HKLM-x32\...\Uplay) (Version: 154.0.11086 - Ubisoft)
UCP3-GUI (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\UCP3-GUI) (Version: 1.0.13 - ucp-team)
UE4 Prerequisites (x64) (HKLM\...\{F9EC45F9-074A-48BF-92E9-A8CADD56F693}) (Version: 1.0.11.0 - Epic Games, Inc.) Hidden
UE4 Prerequisites (x64) (HKLM-x32\...\{4e242cc8-5e3c-4b08-9d55-dbc62ddd1208}) (Version: 1.0.13.0 - Epic Games, Inc.) Hidden
Update for x64-based Windows Systems (KB5001716) (HKLM\...\{DA80A019-4C3B-4DAA-ACA1-6937D7CAAF9E}) (Version: 8.94.0.0 - Microsoft Corporation)
UXP WebView Support (HKLM-x32\...\UXPW_1_2_0) (Version: 1.2.0 - Adobe Inc.)
Vietcong - Gold Edition verze 1.60 (HKLM-x32\...\{C77CF4A8-70F3-41AA-84AE-AA82298A4725}_is1) (Version: 1.60 - )
VobSub 2.23 (HKLM-x32\...\VobSub) (Version: 2.23 - Gabest)
Vortex (HKLM\...\57979c68-f490-55b8-8fed-8b017a5af2fe) (Version: 1.12.6 - Black Tree Gaming Ltd.)
Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Version: 1.0.65.1 - LunarG, Inc.) Hidden
Wargaming.net Game Center (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Wargaming.net Game Center) (Version: 24.8.2.8277 - Wargaming.net)
WeMod (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\WeMod) (Version: 10.12.0 - WeMod)
Windows SDK AddOn (HKLM-x32\...\{E18618EC-D9DB-4BCE-B382-85ADA2CBB340}) (Version: 10.1.0.0 - Microsoft Corporation)
WinRAR 5.60 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.60.0 - win.rar GmbH)
Wondershare Helper Compact 2.6.0 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.6.0 - Wondershare)
Wondershare NativePush(Build 1.0.0.9) (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Wondershare NativePush_is1) (Version: - Wondershare Software)
World of Tanks Blitz (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\1290797664) (Version: - Wargaming.net)
World_of_Warships (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\1461564088) (Version: - Wargaming.net)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)
Zemana AntiMalware verze 3.2.28 (HKLM-x32\...\{4E1F3677-C72E-4F7D-B66E-85467B1A289E}_is1) (Version: 3.2.28 - Zemana)
Zoom (HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\ZoomUMX) (Version: 5.6.6 (961) - Zoom Video Communications, Inc.)

Packages:
=========
Acrobat Notification Client -> C:\Program Files\WindowsApps\AcrobatNotificationClient_1.0.4.0_x86__e1rzdqpraam7r [2021-10-16] (Adobe Systems Incorporated)
Adobe Acrobat -> D:\Adobe\Acrobat DC [2024-12-12] ()
Adobe Notification Client -> C:\Program Files\WindowsApps\AdobeNotificationClient_6.0.0.1_x86__enpm4xejd91yc [2024-05-21] (Adobe Systems Incorporated)
Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2019-11-05] (Autodesk Inc.)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_3.27.1140.0_x64__rz1tebttyb220 [2025-05-16] (Dolby Laboratories)
Doplněk multimediálního modulu pro aplikaci Fotografie -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2019-10-07] (Microsoft Corporation)
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-01-20] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-01-20] (Microsoft Corporation) [MS Ad]
Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_7.0.8.0_neutral__mcm4njqhnhss8 [2024-07-16] (Netflix, Inc.)
NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.967.0_x64__56jybvy8sckqj [2025-05-14] (NVIDIA Corp.)
OfficePushNotificationsUtility -> C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE16 [2025-05-20] ()
Python 3.11 -> C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.11_3.11.2544.0_x64__qbz5n2kfra8p0 [2024-12-07] (Python Software Foundation)
World Conqueror 4 -> C:\Program Files\WindowsApps\EasyTech.WorldConqueror4_1.7.1.0_x86__nz34nvfqxfk3r [2025-04-28] (EasyTech)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2321539691-1916493358-1505984254-1001_Classes\CLSID\{14100442-9664-1407-2647-000000000000}\localserver32 -> "C:\Users\david\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-2321539691-1916493358-1505984254-1001_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Adobe Inc. -> Adobe Inc.)
CustomCLSID: HKU\S-1-5-21-2321539691-1916493358-1505984254-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Inc. -> Adobe Systems)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-10] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-10] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-10] (Adobe Inc. -> )
ContextMenuHandlers1: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana\AntiMalware\AM_ShellExt64.dll [2021-03-30] (Zemana D.O.O. Sarajevo -> Advanced Malware Protection. Copyright 2019.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2024-08-11] (Igor Pavlov) [File not signed]
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-10] (Adobe Inc. -> )
ContextMenuHandlers1: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => D:\Adobe\Acrobat DC\Acrobat Elements\ContextMenuShim64.dll [2025-03-06] (Adobe Inc. -> Adobe Systems Inc.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-06-24] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-06-24] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers2: [DaemonShellExtDriveLite] -> {C06369D6-E77D-4626-9656-1256312BD576} => C:\Program Files\DAEMON Tools Lite\dtshl64.dll [2019-02-09] (AVB Disc Soft, SIA -> Disc Soft Ltd)
ContextMenuHandlers3: [DaemonShellExtImageLite] -> {1D1B5D7B-0FC9-452E-902C-12BACD4FBC20} => C:\Program Files\DAEMON Tools Lite\dtshl64.dll [2019-02-09] (AVB Disc Soft, SIA -> Disc Soft Ltd)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2025-01-12] (Malwarebytes Inc. -> Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2024-08-11] (Igor Pavlov) [File not signed]
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nvmdi.inf_amd64_bfe8dceee6420e76\nvshext.dll [2025-05-07] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana\AntiMalware\AM_ShellExt64.dll [2021-03-30] (Zemana D.O.O. Sarajevo -> Advanced Malware Protection. Copyright 2019.)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2024-08-11] (Igor Pavlov) [File not signed]
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-01-10] (Adobe Inc. -> )
ContextMenuHandlers6: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => D:\Adobe\Acrobat DC\Acrobat Elements\ContextMenuShim64.dll [2025-03-06] (Adobe Inc. -> Adobe Systems Inc.)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2025-01-12] (Malwarebytes Inc. -> Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-06-24] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-06-24] (win.rar GmbH -> Alexander Roshal)

N0váček
Level 2
Level 2
Příspěvky: 165
Registrován: prosinec 14
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod N0váček » 20 kvě 2025 21:27

==================== Codecs (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Drivers32: [vidc.XVID] => C:\Windows\system32\xvidvfw.dll [255488 2011-05-30] () [File not signed]
HKLM\...\Drivers32: [VIDC.FPS1] => C:\Windows\system32\frapsv64.dll [84992 2010-03-31] (Beepa P/L) [File not signed]
HKLM\...\Drivers32: [vidc.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [240640 2011-05-30] () [File not signed]
HKLM\...\Drivers32-x32: [VIDC.VP80] => vp8vfw.dll
HKLM\...\Drivers32: [VIDC.FPS1] => C:\Windows\SysWOW64\frapsvid.dll [86016 2010-03-31] (Beepa P/L) [File not signed]
HKLM\...\Drivers32: [vidc.VP60] => C:\WINDOWS\SysWOW64\vp6vfw.dll [447752 2019-03-22] (Electronic Arts -> On2.com)
HKLM\...\Drivers32: [vidc.VP61] => C:\WINDOWS\SysWOW64\vp6vfw.dll [447752 2019-03-22] (Electronic Arts -> On2.com)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\david\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\David (educapardubice.cz) - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --profile-directory="Profile 1"
ShortcutWithArgument: C:\Users\david\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\225bb61db2f318c1\CamperSh0t - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --profile-directory="Profile 3"

==================== Loaded Modules (Whitelisted) =============

2025-04-24 17:08 - 2025-04-24 17:08 - 003284992 _____ () [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\DotNetCommon\9a0cac3990c8540551e1b20f63c98e4a\DotNetCommon.ni.dll
2025-04-24 17:08 - 2025-04-24 17:08 - 004827136 _____ (Disc Soft Ltd) [File not signed] C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\DiscSoft.NET.Common\1ac64bdc382e483b2345f284fd84b250\DiscSoft.NET.Common.ni.dll
2024-09-09 19:54 - 2024-08-11 15:00 - 000101376 _____ (Igor Pavlov) [File not signed] C:\Program Files\7-Zip\7-zip.dll
2024-11-15 00:57 - 2025-05-14 13:12 - 000000000 ____L (NVIDIA Corporation) [symlink -> C:\Program Files\NVIDIA Corporation\NVIDIA App\MessageBus\NvMessageBusBroadcast.dll] C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem\NvMessageBusBroadcast.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 001224704 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\XPPen\LIBEAY32.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000279040 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\XPPen\SSLEAY32.dll
2025-05-20 16:50 - 2025-05-20 16:50 - 002849280 _____ (The OpenSSL Project, hxxps://www.openssl.org/) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\libcrypto-1_1-x64.dll
2025-05-20 16:50 - 2025-05-20 16:50 - 000685056 _____ (The OpenSSL Project, hxxps://www.openssl.org/) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\libssl-1_1-x64.dll
2024-11-22 13:26 - 2023-07-28 16:48 - 000036352 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\XPPen\imageformats\qdds.dll
2025-05-20 16:50 - 2025-05-20 16:50 - 000046592 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\bearer\qgenericbearer.dll
2025-05-20 16:50 - 2025-05-20 16:50 - 006270976 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Core.dll
2025-05-20 16:50 - 2025-05-20 16:50 - 001389568 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Network.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000026112 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qgif.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000033280 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qicns.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000027648 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qico.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000243712 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qjpeg.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000021504 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qsvg.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000020992 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qtga.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000333824 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qtiff.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000019968 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qwbmp.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000415232 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\imageformats\qwebp.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 001064960 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\platforms\qwindows.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 004814336 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\Qt5Core.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 004965376 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\Qt5Gui.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000930304 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\Qt5Network.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000264704 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\Qt5Svg.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 004464640 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\Qt5Widgets.dll
2024-11-22 13:26 - 2024-09-09 16:34 - 000149504 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\XPPen\Qt5Xml.dll

==================== Alternate Data Streams (Whitelisted) ========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\david:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\DP45977C.lfl:677104FCAA [3442]
AlternateDataStreams: C:\ProgramData\goyslgxe.nnn:7297ACA992 [3442]
AlternateDataStreams: C:\ProgramData\lzmiudcz.flf:B96BCC688C [3442]
AlternateDataStreams: C:\ProgramData\settings.ini:27EB0451C1 [3442]
AlternateDataStreams: C:\ProgramData\settings.ini:5B48B5BC13 [3442]
AlternateDataStreams: C:\ProgramData\wobcpcvn.rxt:597BC1DFF5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\Users\david\Data aplikací:fc7b7d0f14c2a9475ac28a6ca7e82bc5 [394]
AlternateDataStreams: C:\Users\david\AppData\Roaming:fc7b7d0f14c2a9475ac28a6ca7e82bc5 [394]
AlternateDataStreams: C:\Users\david\AppData\Local\Microsoft:ISBD [32]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [464]
AlternateDataStreams: C:\Users\Public\Documents\settings.ini:ABCC4E1BB3 [3442]

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\amsdk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\amsdk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) =============

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2025-05-14] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre-1.8\bin\ssv.dll [2024-03-13] (Oracle America, Inc. -> Oracle Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2025-04-24] (Adobe Inc. -> Adobe Systems Incorporated)
BHO: No Name -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll [2024-03-13] (Oracle America, Inc. -> Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2025-04-24] (Adobe Inc. -> Adobe Systems Incorporated)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2025-05-14] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2025-04-24] (Adobe Inc. -> Adobe Systems Incorporated)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2025-04-24] (Adobe Inc. -> Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2025-04-24] (Adobe Inc. -> Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2025-04-24] (Adobe Inc. -> Adobe Systems Incorporated)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2025-05-14] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2025-05-14] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2025-05-14] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2025-05-14] (Microsoft Corporation -> Microsoft Corporation)

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\sharepoint.com -> hxxps://educanetpardubice-files.sharepoint.com

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2018-04-12 01:38 - 2025-05-19 14:08 - 000000841 _____ C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files\Common Files\Oracle\Java\javapath;C:\Program Files (x86)\Common Files\Oracle\Java\java8path;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files\Eclipse Adoptium\jdk-17.0.7.7-hotspot\bin;C:\Program Files (x86)\Common Files\Intel\Shared Libraries\redist\intel64\compiler;D:\Oculus\Support\oculus-runtime;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\Git\cmd;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\dotnet\;C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\130\Tools\Binn\;C:\Program Files (x86)\Microsoft SQL Server\140\Tools\Binn\;C:\Program Files\Microsoft SQL Server\140\Tools\Binn\;C:\Program Files\Microsoft SQL Server\140\DTS\Binn\;C:\Program Files\NVIDIA Corporation\NVIDIA app\NvDLISR
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\Control Panel\Desktop\\Wallpaper -> D:\stažené\1181113-1920x1080-desktop-1080p-gears-of-war-wallpaper-photo.jpg
HKU\S-1-5-80-946198592-2590030008-2715608072-3844483542-1856439106\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
DNS Servers: 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall is disabled.

Network Binding:
=============
Ethernet: Intel(R) Ethernet Connection (2) I219-V -> e1d68x64.sys
Ethernet 3: WeOnlyDo Network Adapter 2.5 -> wod0205.sys

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run: => "Wondershare Helper Compact.exe"
HKLM\...\StartupApproved\Run: => "UniConverterUpdateHelper"
HKLM\...\StartupApproved\Run32: => "RadminVPN"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKLM\...\StartupApproved\Run32: => "Adobe CCXProcess"
HKLM\...\StartupApproved\Run32: => "Acrobat Assistant 8.0"
HKLM\...\StartupApproved\Run32: => "TeamsMachineInstaller"
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\StartupApproved\Run: => "Discord"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\StartupApproved\Run: => "CCleaner Smart Cleaning"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\StartupApproved\Run: => "Gaijin.Net Updater"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\StartupApproved\Run: => "Wargaming.net Game Center"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\StartupApproved\Run: => "RiotClient"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\StartupApproved\Run: => "Overwolf"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [TCP Query User{F8EF4DEA-3E1B-4BAA-A636-16A31817527B}D:\oculus\support\oculus-runtime\ovrserver_x64.exe] => (Allow) D:\oculus\support\oculus-runtime\ovrserver_x64.exe (Facebook Technologies, LLC -> Facebook Technologies, LLC)
FirewallRules: [UDP Query User{9FAD221A-E1E1-4703-B272-9F0A69A03EEA}D:\oculus\support\oculus-runtime\ovrserver_x64.exe] => (Allow) D:\oculus\support\oculus-runtime\ovrserver_x64.exe (Facebook Technologies, LLC -> Facebook Technologies, LLC)
FirewallRules: [{7EB8DD80-AF1B-43F3-AA67-A2CAC09F9619}] => (Block) D:\oculus\support\oculus-runtime\ovrserver_x64.exe (Facebook Technologies, LLC -> Facebook Technologies, LLC)
FirewallRules: [{7A4AC61E-9FD0-4D10-B393-78FA6A4CA3FA}] => (Block) D:\oculus\support\oculus-runtime\ovrserver_x64.exe (Facebook Technologies, LLC -> Facebook Technologies, LLC)
FirewallRules: [TCP Query User{A50EF323-AF45-4691-8544-A5F61EFE72EF}D:\steam\steam.exe] => (Allow) D:\steam\steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [UDP Query User{2A047186-FB59-42EF-AE4A-19C62097560C}D:\steam\steam.exe] => (Allow) D:\steam\steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{0972C763-0C82-49F1-8E71-669883E9E81C}] => (Allow) D:\steam\steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{B122F07F-98B3-4A35-8322-7BF1D30AC33F}] => (Allow) D:\steam\steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{F83D9B13-3D32-4967-A804-1C12EA9D466D}] => (Allow) D:\steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{8FCBF0EB-DC82-4E3C-953F-A11507CA9ECB}] => (Allow) D:\steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [TCP Query User{EEC236EF-AEF2-4335-A294-0F00157E1F08}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [UDP Query User{B78F49FB-36B7-4343-A3F0-6CCE2EAA2E99}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{9FECC803-4161-41B7-9CA8-EB399D314F92}] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{88343F89-59F5-4999-A090-2A31898CF54F}] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [TCP Query User{07D32D2A-C610-4AD3-9094-DA0093EC61E2}D:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) D:\riot games\riot client\riotclientelectron\riot client.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [UDP Query User{4728AE00-C2A3-4BDE-8DE5-A4DEA092148D}D:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) D:\riot games\riot client\riotclientelectron\riot client.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [{A308C28C-BDDE-42A8-A631-B4F1FD534165}] => (Block) D:\riot games\riot client\riotclientelectron\riot client.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [{56F32322-FA37-4FB8-97FF-20C544B4B45A}] => (Block) D:\riot games\riot client\riotclientelectron\riot client.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [TCP Query User{4A82A736-78BE-4300-8ECE-77D7666C38FB}D:\steam\steamapps\common\battlefield 1\bf1.exe] => (Allow) D:\steam\steamapps\common\battlefield 1\bf1.exe (Electronic Arts, Inc. -> EA Digital Illusions CE AB)
FirewallRules: [UDP Query User{8EE9A0C1-8F04-4B14-95B9-228C742069EE}D:\steam\steamapps\common\battlefield 1\bf1.exe] => (Allow) D:\steam\steamapps\common\battlefield 1\bf1.exe (Electronic Arts, Inc. -> EA Digital Illusions CE AB)
FirewallRules: [{595FE24B-2536-4DF1-B796-34C9FF5F9BD5}] => (Block) D:\steam\steamapps\common\battlefield 1\bf1.exe (Electronic Arts, Inc. -> EA Digital Illusions CE AB)
FirewallRules: [{7ED873A0-7CE5-4D79-A37A-B2DE15DCFDB7}] => (Block) D:\steam\steamapps\common\battlefield 1\bf1.exe (Electronic Arts, Inc. -> EA Digital Illusions CE AB)
FirewallRules: [{19A9DDB5-88FC-436C-AE98-36B042BF8DBE}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E7A6459F-4638-4488-B724-6D1CE6AC5DBD}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{D62E5866-BAF9-4533-86D6-C0027199AA04}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{72C5C0A9-B158-468C-92A8-F79BD1ED6279}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E54E561F-2BD5-48A8-9369-F0F9ACAC6B67}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{282E892A-8F7E-4B54-A7BB-B1B366B82224}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{385B1CF8-8114-4B4E-926D-4F88A233F799}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe (Electronic
Arts, Inc. -> Electronic Arts)
FirewallRules: [{B821C4ED-B125-4DF2-BF17-F3FDB890FE43}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{6D392EA0-1EFD-43F9-ACFC-77FB7B5B0E93}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{780A5AF4-8380-4DFD-AB70-F59A5A6BC9FA}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{68526E17-5969-4089-8D72-4601170A028B}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{5887378C-A9FB-4A7B-A4E5-E7A00713FDA3}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAGEP.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{CCA4F999-8DCF-4590-952B-114CC7E7C7BC}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAGEP.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{83F21014-8F2D-46E8-A11E-BA1A77790ACC}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{16F4C583-5C5A-418E-AAF7-679B4E512B78}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{6670CB6F-A7B6-4902-97DE-A224BFB5F064}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALaunchHelper.exe (Electronic Arts, Inc. -> Electronic Arts)
FirewallRules: [{CDEAF2B5-4CC8-4BE3-9B4A-F86394279447}] => (Allow) D:\steam\steamapps\common\DIDE\DeadIslandGame.exe (Techland Sp. z o.o. -> Techland)
FirewallRules: [{72A066BD-DADA-4577-AA25-646BA837118C}] => (Allow) D:\steam\steamapps\common\DIDE\DeadIslandGame.exe (Techland Sp. z o.o. -> Techland)

==================== Restore Points =========================

19-05-2025 14:07:43 zoek.exe restore point

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:
==================
Error: (05/20/2025 03:02:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname DESKTOP-OKDVTKV.local already in use; will try DESKTOP-OKDVTKV-2.local instead

Error: (05/20/2025 03:02:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister 4 DESKTOP-OKDVTKV.local. Addr 192.168.8.101

Error: (05/20/2025 03:02:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.8.101:5353 16 DESKTOP-OKDVTKV.local. AAAA FD20:DA22:56BA:E200:43E0:755F:E168:01A6

Error: (05/20/2025 03:02:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 DESKTOP-OKDVTKV.local. AAAA FE80:0000:0000:0000:036B:24D3:2DED:648F

Error: (05/20/2025 03:02:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.8.101:5353 16 DESKTOP-OKDVTKV.local. AAAA FD20:DA22:56BA:E200:43E0:755F:E168:01A6

Error: (05/20/2025 03:02:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 4 DESKTOP-OKDVTKV.local. Addr 192.168.8.101

Error: (05/20/2025 03:02:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.8.101:5353 16 DESKTOP-OKDVTKV.local. AAAA FD20:DA22:56BA:E200:43E0:755F:E168:01A6

Error: (05/20/2025 03:02:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 DESKTOP-OKDVTKV.local. AAAA FE80:0000:0000:0000:036B:24D3:2DED:648F


System errors:
=============
Error: (05/20/2025 03:03:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba Steam Client Service neuspěla při spuštění v důsledku následující chyby:
Služba neodpověděla na řídicí nebo zahajovací požadavek dostatečně včas.

Error: (05/20/2025 03:03:40 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Při čekání na připojení služby Steam Client Service bylo dosaženo časového limitu (60000 ms).

Error: (05/20/2025 03:02:25 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update a Secure Boot variable with error (-2147020471 = Zabezpečené spouštění není v tomto počítači zapnuto.). For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931

Error: (05/19/2025 02:32:17 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update a Secure Boot variable with error (-2147020471 = Zabezpečené spouštění není v tomto počítači zapnuto.). For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931

Error: (05/19/2025 02:29:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba Služba Aktualizace Google (gupdate) neuspěla při spuštění v důsledku následující chyby:
Služba neodpověděla na řídicí nebo zahajovací požadavek dostatečně včas.

Error: (05/19/2025 02:29:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Při čekání na připojení služby Služba Aktualizace Google (gupdate) bylo dosaženo časového limitu (60000 ms).

Error: (05/19/2025 02:27:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba GameInput Service byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 1000 milisekund: Restartovat službu.

Error: (05/19/2025 02:27:18 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Služba GameInput Service byla ukončena s následující chybou:
Složený soubor GameInput Service byl vytvořen s novější verzi úložného prostoru.


Windows Defender:
================
Date: 2025-05-19 14:28:37
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid ... terprise=0
Name: HackTool:Win64/Malgent!AMTB
Severity: High
Category: Tool
Path: file:_C:\Windows\System32\drivers\truesight.sys
Detection Origin: Local machine
Detection Type: FastPath
Detection Source: Real-Time Protection
Process Name: C:\Program Files\RogueKiller\RogueKillerSvc.exe
Security intelligence Version: AV: 1.429.56.0, AS: 1.429.56.0, NIS: 1.429.56.0
Engine Version: AM: 1.1.25040.1, NIS: 1.1.25040.1

Date: 2025-05-19 14:01:34
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid ... terprise=0
Name: HackTool:Win64/Malgent!AMTB
Severity: High
Category: Tool
Path: file:_C:\Windows\System32\drivers\truesight.sys
Detection Origin: Local machine
Detection Type: FastPath
Detection Source: Real-Time Protection
Process Name: C:\Windows\System32\svchost.exe
Security intelligence Version: AV: 1.429.56.0, AS: 1.429.56.0, NIS: 1.429.56.0
Engine Version: AM: 1.1.25040.1, NIS: 1.1.25040.1

Date: 2025-05-19 14:01:34
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid ... terprise=0
Name: HackTool:Win64/Malgent!AMTB
Severity: High
Category: Tool
Path: file:_C:\Windows\System32\drivers\truesight.sys; regkey:_HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TrueSight
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\RogueKiller\RogueKillerSvc.exe
Security intelligence Version: AV: 1.429.56.0, AS: 1.429.56.0, NIS: 1.429.56.0
Engine Version: AM: 1.1.25040.1, NIS: 1.1.25040.1

Date: 2025-05-19 14:01:16
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid ... terprise=0
Name: HackTool:Win64/Malgent!AMTB
Severity: High
Category: Tool
Path: file:_C:\Windows\System32\drivers\truesight.sys
Detection Origin: Local machine
Detection Type: FastPath
Detection Source: Real-Time Protection
Process Name: C:\Windows\System32\svchost.exe
Security intelligence Version: AV: 1.429.56.0, AS: 1.429.56.0, NIS: 1.429.56.0
Engine Version: AM: 1.1.25040.1, NIS: 1.1.25040.1

Date: 2025-05-19 14:01:11
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid ... terprise=0
Name: HackTool:Win64/Malgent!AMTB
Severity: High
Category: Tool
Path: file:_C:\Windows\System32\drivers\truesight.sys
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\RogueKiller\RogueKillerSvc.exe
Security intelligence Version: AV: 1.429.56.0, AS: 1.429.56.0, NIS: 1.429.56.0
Engine Version: AM: 1.1.25040.1, NIS: 1.1.25040.1

CodeIntegrity:
===============
Date: 2025-05-20 15:03:30
Description:
Code Integrity determined that a process (\Device\HarddiskVolume5\Users\david\AppData\Local\Discord\app-1.0.9191\Discord.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Overwolf\0.275.0.13\OWClient.dll that did not meet the Microsoft signing level requirements.

Date: 2025-05-20 15:03:29
Description:
Code Integrity determined that a process (\Device\HarddiskVolume5\Users\david\AppData\Local\Discord\app-1.0.9191\Discord.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Overwolf\0.275.0.13\ow-graphics-vulkan.dll that did not meet the Microsoft signing level requirements.


==================== Memory info ===========================

BIOS: American Megatrends Inc. P1.80 03/20/2018
Motherboard: ASRock Z370 Extreme4
Processor: Intel(R) Core(TM) i5-8600K CPU @ 3.60GHz
Percentage of memory in use: 39%
Total physical RAM: 16317.91 MB
Available physical RAM: 9844.3 MB
Total Virtual: 22461.91 MB
Available Virtual: 12552.53 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:222.97 GB) (Free:50.77 GB) (Model: KINGSTON SA1000M8240G) NTFS
Drive d: (Programy,hry) (Fixed) (Total:1863.02 GB) (Free:78.69 GB) (Model: ST2000DM006-2DM164) NTFS
Drive f: (ROADRASH) (CDROM) (Total:0.48 GB) (Free:0 GB) CDFS

\\?\Volume{6522a7b5-a0fe-4ff7-aad0-813eb3dd8254}\ (Obnovení) (Fixed) (Total:0.49 GB) (Free:0.06 GB) NTFS
\\?\Volume{049851ea-6c37-48ed-abea-5dc624cdd506}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (Protective MBR) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT.

==========================================================
Disk: 1 (Size: 223.6 GB) (Disk ID: 10E010E0)

Partition: GPT.

==================== End of Addition.txt =======================

N0váček
Level 2
Level 2
Příspěvky: 165
Registrován: prosinec 14
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod N0váček » 20 kvě 2025 21:27

FRST.txt log:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-05-2025
Ran by david (administrator) on DESKTOP-OKDVTKV (20-05-2025 21:22:40)
Running from C:\Users\david\Desktop\FRST64.exe
Loaded Profiles: david & SQLTELEMETRY$DUEL
Platform: Microsoft Windows 10 Pro Version 22H2 19045.5854 (X64) Language: Čeština (Česko)
Default browser: Chrome
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Inc. -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Crash Processor.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe
(C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ->) (Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe ->) (OpenJS Foundation -> Node.js) C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe
(C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(conhost.exe ->) (Discord Inc. -> Discord Inc.) C:\Users\david\AppData\Local\Discord\app-1.0.9191\Discord.exe <6>
(D:\Oculus\Support\oculus-runtime\OVRServiceLauncher.exe ->) (Facebook Technologies, LLC -> Facebook Technologies, LLC) D:\Oculus\Support\oculus-runtime\OVRRedir.exe
(D:\Oculus\Support\oculus-runtime\OVRServiceLauncher.exe ->) (Facebook Technologies, LLC -> Facebook Technologies, LLC) D:\Oculus\Support\oculus-runtime\OVRServer_x64.exe
(D:\steam\steam.exe ->) (Valve Corp. -> Valve Corporation) D:\steam\bin\cef\cef.win7x64\steamwebhelper.exe <8>
(explorer.exe ->) (Adobe Inc. -> Adobe Systems Incorporated) D:\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe <2>
(explorer.exe ->) (AVB Disc Soft, SIA -> Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTAgent.exe
(explorer.exe ->) (Hanvon Ugee Technology Co., Ltd. -> XPPEN TECHNOLOGY CO.) C:\Program Files\XPPen\PenTablet.exe
(explorer.exe ->) (Riot Games, Inc. -> Riot Games, Inc.) C:\Program Files\Riot Vanguard\vgtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <5>
(Microsoft Corporation -> Microsoft Corporation) C:\Users\david\AppData\Local\Microsoft\OneDrive\25.075.0420.0002\Microsoft.SharePoint.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Apple Inc. -> Apple Inc.) C:\Program Files (x86)\Blizzard\Bonjour Service\mDNSResponder.exe
(services.exe ->) (AVB Disc Soft, SIA -> Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(services.exe ->) (Electronic Arts, Inc. -> Electronic Arts) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe
(services.exe ->) (Facebook Technologies, LLC -> Facebook Technologies, LLC) D:\Oculus\Support\oculus-runtime\OVRServiceLauncher.exe
(services.exe ->) (Hewlett-Packard Company -> HP) C:\Windows\System32\HPSIsvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_d51901c26227fb29\WMIRegistrationService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL14.DUEL\MSSQL\Binn\sqlceip.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL14.DUEL\MSSQL\Binn\sqlservr.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MsMpEng.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvmdi.inf_amd64_bfe8dceee6420e76\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(sihost.exe ->) (Adobe Systems Incorporated -> ) C:\Program Files\WindowsApps\AcrobatNotificationClient_1.0.4.0_x86__e1rzdqpraam7r\FullTrustNotifier.exe
(sihost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2502.2.0_x64__8wekyb3d8bbwe\CalculatorApp.exe
(svchost.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\WindowsApps\AdobeNotificationClient_6.0.0.1_x86__enpm4xejd91yc\AdobeNotificationClient.exe
(svchost.exe ->) (Adobe Systems Incorporated -> ) C:\Program Files\WindowsApps\AcrobatNotificationClient_1.0.4.0_x86__e1rzdqpraam7r\AcrobatNotificationClient.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\SecurityHealthHost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
(Valve Corp. -> Valve Corporation) D:\steam\steam.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [10752424 2025-01-14] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [Riot Vanguard] => C:\Program Files\Riot Vanguard\vgtray.exe [4143376 2025-05-05] (Riot Games, Inc. -> Riot Games, Inc.)
HKLM\...\Run: [PenTablet] => C:\Program Files\XPPen\PenTablet.exe [10647528 2024-09-23] (Hanvon Ugee Technology Co., Ltd. -> XPPEN TECHNOLOGY CO.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe CCXProcess] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [133128 2024-05-21] (Adobe Inc. -> Adobe Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (No File)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [750680 2024-03-13] (Oracle America, Inc. -> Oracle Corporation)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [1145256 2025-04-17] (Adobe Inc. -> Adobe Inc.)
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [Steam] => D:\steam\steam.exe [4698720 2025-05-19] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [45875504 2025-03-12] (Gen Digital Inc. -> Gen Digital Inc.)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [735336 2019-02-09] (AVB Disc Soft, SIA -> Disc Soft Ltd)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] () [File not signed]
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [Adobe Acrobat Synchronizer] => D:\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [34143128 2025-04-24] (Adobe Inc. -> Adobe Systems Incorporated)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [RiotClient] => D:\Riot Games\Riot Client\RiotClientServices.exe [74778904 2025-05-18] (Riot Games, Inc. -> Riot Games, Inc.)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [EADM] => C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe [3839072 2025-05-20] (Electronic Arts, Inc. -> Electronic Arts)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1894144 2025-05-07] (Overwolf Ltd -> Overwolf Ltd.)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [Discord] => C:\Users\david\AppData\Local\Discord\Update.exe [1526504 2024-04-09] (Discord Inc. -> GitHub)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [Gaijin.Net Updater] => C:\Users\david\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [3067056 2024-02-14] (GAIJIN NETWORK LTD -> Gaijin)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [ZeroTierUI] => C:\Program Files (x86)\ZeroTier\One\zerotier_desktop_ui.exe (No File)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [MicrosoftEdgeAutoLaunch_30FCCE2722F4190AAE310221237BB02B] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4045864 2025-05-15] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe [2888616 2025-04-17] (Adobe Inc. -> Adobe Inc.)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\david\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (No File)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\david\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" [89680192 2025-05-20] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\RunOnce: [Uninstall 25.065.0406.0002] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\david\AppData\Local\Microsoft\OneDrive\25.065.0406.0002" [0 2025-05-20] () <==== ATTENTION [zero byte File/Folder]
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\MountPoints2: {a63fa35f-2b15-11e9-ae21-7085c27f60c4} - "F:\AutoRun.exe"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\MountPoints2: {e74685d5-bef7-11ec-aee5-7085c27f60c4} - "G:\SISetup.exe"
HKLM\...\Windows x64\Print Processors\HP1100PrintProc: C:\Windows\System32\spool\prtprocs\x64\HP1100PP.DLL [74240 2012-08-31] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM\...\Print\Monitors\Adobe PDF Port Monitor: C:\Windows\system32\AdobePDF.dll [203936 2021-12-24] (Adobe Inc. -> Adobe Systems Inc)
HKLM\...\Print\Monitors\HP1100LM: C:\Windows\system32\HP1100LM.DLL [288768 2012-08-31] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM\Software\...\AppCompatFlags\Custom\Heroes3.exe: [{1d3c859c-1028-4822-b0a7-da4f7bbc18bc}.sdb] -> GOG.com Heroes of Might and Magic 3
HKLM\Software\...\AppCompatFlags\InstalledSDB\{1d3c859c-1028-4822-b0a7-da4f7bbc18bc}: [DatabasePath] -> C:\Windows\AppPatch\CustomSDB\{1d3c859c-1028-4822-b0a7-da4f7bbc18bc}.sdb [2012-11-28]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\136.0.7103.114\Installer\chrmstp.exe [2025-05-15] (Google LLC -> Google LLC)
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {04E46EFD-1B14-420C-A507-752FCB268DEE} - System32\Tasks\2K Launcher
Task: {96BF6198-83EE-442B-AD22-9DA883C27B53} - System32\Tasks\2K Launcher Steam => C:\Users\david\AppData\Local\T2GP Launcher\pcr-1.15.0.1805\LauncherPatcher.exe [7371752 2024-07-13] (Take-Two Interactive Software, Inc. -> Take-Two Interactive Software, Inc.) -> D:\steam\steamapps\common\XCOM 2\2KLauncher\Steam 268500 76561198063570665 -- -steam_auto_login -game-61483=-review -game-61483=-noRedscreens
Task: {8461D7E7-B6A3-46AC-9628-483376542B7E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1580992 2025-03-21] (Adobe Inc. -> Adobe Inc.)
Task: {7687B342-874D-4D4D-9B69-7616FD9B20A3} - System32\Tasks\Adobe Uninstaller => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [446376 2025-04-17] (Adobe Inc. -> Adobe Inc.)
Task: {A7F5BCC3-ADFB-4F23-8A56-B5CB0819A3DF} - System32\Tasks\AdobeCreativeCloud_ScheduleUpdates => C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe [2888616 2025-04-17] (Adobe Inc. -> Adobe Inc.)
Task: {C4682E69-EB83-4904-B807-7B2A68BEB733} - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [10752424 2025-01-14] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {83A20655-8390-41AD-8B20-451E8AA61D03} - System32\Tasks\Adobe-Genuine-Software-Integrity-Scheduler-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [11065256 2025-01-14] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {01A1B8E7-0BDE-422B-8D85-B647F2A97E9C} - System32\Tasks\AMHelper => C:\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe [682008 2021-03-30] (Zemana D.O.O. Sarajevo -> Zemana Ltd.)
Task: {081585BE-5475-42BA-9E65-4470CA8F56E2} - System32\Tasks\AMSkipUAC => C:\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe [682008 2021-03-30] (Zemana D.O.O. Sarajevo -> Zemana Ltd.)
Task: {EA9D2563-6AEB-4101-9D10-5D85F0CAD46D} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [3480504 2025-03-12] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {A797A223-53F8-4CC5-975C-FCE6B8839166} - System32\Tasks\CCleanerCrashReporting => C:\Program Files\CCleaner\CCleanerBugReport.exe [6139696 2025-03-12] (Gen Digital Inc. -> Gen Digital Inc.) -> --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --guid "190a0680-e145-4ab1-8e54-b54ab4ed27ae" --version "6.34.0.11482" --silent
Task: {BE7445F7-E681-47C4-97DE-E8001C094C0A} - System32\Tasks\CCleanerSkipUAC - david => C:\Program Files\CCleaner\CCleaner.exe [39616304 2025-03-12] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {ABF2C9C8-9494-414B-8C8F-989AAAA72E40} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem138.0.7156.0{8AE088AA-8597-4733-A646-C67434DEF469} => C:\Program Files (x86)\Google\GoogleUpdater\138.0.7156.0\updater.exe [7096416 2025-05-02] (Google LLC -> Google LLC)
Task: {549D0AA3-307E-431D-83FF-C355B22D107A} - System32\Tasks\Intel PTT EK Recertification => C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_fc84dfa25a6a7727\lib\IntelPTTEKRecertification.exe [855664 2023-12-14] (Intel Corporation -> Intel(R) Corporation)
Task: {303B67E0-0D3D-4DD0-B77E-A14B27E7953E} - System32\Tasks\Microsoft Office 15 Sync Maintenance for DESKTOP-OKDVTKV-david DESKTOP-OKDVTKV => C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE [469640 2012-10-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {E7842ED2-B831-4C74-9E5E-06002894D6B4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [1642672 2012-10-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {76B79278-437D-4536-8E46-E91D417342D4} - System32\Tasks\Microsoft\Office\Office Apps Prewarm => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [219344 2025-05-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {7B556011-F652-4FBA-B6E2-40B971C11B90} - System32\Tasks\Microsoft\Office\Office Apps Prewarm Recurring => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [219344 2025-05-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {112C82AF-6D83-49C9-AEAB-661242CE2C03} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29102272 2025-05-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {B5B4BF9E-30CA-41C1-BFA0-49308229746F} - System32\Tasks\Microsoft\Office\Office Background Push Maintenance => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonx86\Microsoft Shared\OFFICE16\opushutil.exe [59608 2025-05-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {3F7D5183-D222-49F9-ADFA-7790FD9D3F89} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29102272 2025-05-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {EFCFECAC-22E3-4021-A9D8-A4FCB8BFEC0C} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [219344 2025-05-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {CC97DDFA-EA1F-4470-B745-890D31E4AC65} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [219344 2025-05-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {2999F376-D6E0-4469-86A3-9F9AC8CB27DF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [375416 2012-10-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {CDF1018D-5E76-4A79-8C7C-1155AF916A5E} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [375416 2012-10-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {01470F3A-BCC8-4FB5-963C-AE6E69189E72} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpCmdRun.exe [1745176 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {3F5F6EAD-2FED-4371-A029-CADC328FD962} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpCmdRun.exe [1745176 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {0C3A2340-6F9A-454B-A909-14E73CB4663B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpCmdRun.exe [1745176 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {7D6709E4-0810-464B-92BC-CBF2F04E413C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpCmdRun.exe [1745176 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {364F8B5C-2549-40E7-B5DD-37AF70BAF2AD} - System32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA App.exe [3275808 2025-05-06] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {FB837B3C-1A62-409C-9E00-BD6E25C90EC1} - System32\Tasks\OneDrive Startup Task-S-1-5-21-2321539691-1916493358-1505984254-1001 => C:\Users\david\AppData\Local\Microsoft\OneDrive\25.075.0420.0002\OneDriveLauncher.exe [679728 2025-05-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {348542BB-76C6-46B8-AEA1-BB1FDC430ED4} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe [2397952 2025-05-07] (Overwolf Ltd -> Overwolf LTD) -> C:\Program Files (x86)\Overwolf\/RunningFrom Schedule

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CCleanerCrashReporting.job => C:\Program Files\CCleaner\CCleanerBugReport.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.8.1
Tcpip\..\Interfaces\{c340d052-3452-48e4-80a2-9f3c8d9a8c3b}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{ea3b0425-ca47-4234-8b00-f15e989399ff}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{ea3b0425-ca47-4234-8b00-f15e989399ff}: [DhcpNameServer] 192.168.8.1

Edge:
=======
Edge Profile: C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default [2025-05-20]
Edge Extension: (Dokumenty Google offline) - C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-05-19]
Edge Extension: (Edge relevant text changes) - C:\Users\david\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2025-05-19]

FireFox:
========
FF HKLM\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - D:\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Extension: (Adobe Acrobat) - D:\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2021-07-23]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - D:\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Plugin: @java.com/DTPlugin,version=11.411.2 -> C:\Program Files\Java\jre-1.8\bin\dtplugin\npDeployJava1.dll [2024-03-13] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.411.2 -> C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll [2024-03-13] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2025-04-17] (Adobe Inc. -> Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32.dll [2020-09-30] (Adobe Systems Incorporated -> )
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2025-04-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2025-04-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Acrobat -> D:\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2025-04-24] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2025-04-17] (Adobe Inc. -> Adobe Systems)

Chrome:
=======
CHR DefaultProfile: Profile 3
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1 [2025-05-20]
CHR Extension: (Adobe Acrobat: PDF edit, convert, sign tools) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2025-05-20]
CHR Extension: (Dokumenty Google offline) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-05-20]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2025-05-20]
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3 [2025-05-20]
CHR DownloadDir: C:\Users\david\Desktop
CHR Extension: (uBlock Origin) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2025-05-19]
CHR Extension: (uBlock Origin Lite) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\ddkjiahejlhfcafbddmgiahcphecmpfh [2025-05-19]
CHR Extension: (Adobe Acrobat: PDF edit, convert, sign tools) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2025-05-19]
CHR Extension: (ChatGPT) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\ejcfepkfckglbgocfkanmcdngdijcgld [2025-05-19]
CHR Extension: (Dokumenty Google offline) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-05-19]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2025-05-19]
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 4 [2025-05-20]
CHR Extension: (Adobe Acrobat: PDF edit, convert, sign tools) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2025-05-20]
CHR Extension: (Dokumenty Google offline) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-05-20]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2025-05-20]
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\System Profile [2025-05-20]
CHR HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [174520 2025-03-21] (Adobe Inc. -> Adobe Inc.)
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [944040 2025-04-17] (Adobe Inc. -> Adobe Inc.)
S3 battlenet_helpersvc; C:\ProgramData\Battle.net_components\battlenet_helpersvc\AgentHelper.exe [3318400 2025-02-18] (Blizzard Entertainment, Inc. -> Blizzard Entertainment)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [18663720 2025-04-16] (BattlEye Innovations e.K. -> )
R2 Bonjour Service; C:\Program Files (x86)\Blizzard\Bonjour Service\mDNSResponder.exe [390504 2019-06-02] (Apple Inc. -> Apple Inc.)
S3 CCleanerPerformanceOptimizerService; C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe [1088816 2025-03-12] (Gen Digital Inc. -> Gen Digital Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [13824240 2025-05-08] (Microsoft Corporation -> Microsoft Corporation)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [4132456 2019-02-09] (AVB Disc Soft, SIA -> Disc Soft Ltd)
S3 EAAntiCheatService; C:\Program Files\EA\AC\eaanticheat.gameservice.exe [108986048 2025-05-07] (Electronic Arts, Inc. -> Electronic Arts)
R3 EABackgroundService; C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe [18917472 2025-05-20] (Electronic Arts, Inc. -> Electronic Arts)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [811496 2023-02-04] (EasyAntiCheat Oy -> Epic Games, Inc)
S3 EasyAntiCheat_EOS; C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe [954704 2025-04-23] (EasyAntiCheat Oy -> Epic Games, Inc.)
R2 HPSIService; C:\WINDOWS\system32\HPSIsvc.exe [126880 2012-09-27] (Hewlett-Packard Company -> HP)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [9406208 2025-05-14] (Malwarebytes Inc -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [2788304 2025-01-12] (Malwarebytes Inc. -> Malwarebytes)
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MpDefenderCoreService.exe [2009608 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 MSSQL$DUEL; C:\Program Files\Microsoft SQL Server\MSSQL14.DUEL\MSSQL\Binn\sqlservr.exe [485048 2017-08-22] (Microsoft Corporation -> Microsoft Corporation)
S3 npggsvc; C:\WINDOWS\SysWOW64\GameMon.des [13142392 2024-04-05] (INCA Internet Co.,Ltd. -> INCA Internet Co., Ltd.)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nvmdi.inf_amd64_bfe8dceee6420e76\Display.NvContainer\NVDisplay.Container.exe [1274992 2025-05-07] (NVIDIA Corporation -> NVIDIA Corporation)
S3 OverwolfUpdater; C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe [2397952 2025-05-07] (Overwolf Ltd -> Overwolf LTD)
S3 OVRLibraryService; D:\Oculus\Support\oculus-librarian\OVRLibraryService.exe [146688 2024-07-29] (Facebook Technologies, LLC -> Facebook Technologies, LLC)
R2 OVRService; D:\Oculus\Support\oculus-runtime\OVRServiceLauncher.exe [418048 2024-07-29] (Facebook Technologies, LLC -> Facebook Technologies, LLC)
S2 rkrtservice; C:\Program Files\RogueKiller\RogueKillerSvc.exe [16014768 2023-09-18] (ADLICE -> )
S3 Rockstar Service; D:\Program Files\Rockstar Games\Launcher\RockstarService.exe [6669296 2024-02-24] (Rockstar Games, Inc. -> Rockstar Games)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [559304 2025-04-09] (Microsoft Windows Publisher -> Microsoft Corporation)
S4 SQLAgent$DUEL; C:\Program Files\Microsoft SQL Server\MSSQL14.DUEL\MSSQL\Binn\SQLAGENT.EXE [578744 2017-08-22] (Microsoft Corporation -> Microsoft Corporation)
R2 SQLTELEMETRY$DUEL; C:\Program Files\Microsoft SQL Server\MSSQL14.DUEL\MSSQL\Binn\sqlceip.exe [246968 2017-08-22] (Microsoft Corporation -> Microsoft Corporation)
S3 TavernWorker_1_1; C:\Program Files\IRONMACE\Tavern\Steam\TavernApp_1_1\TavernWorker.exe [26065328 2024-07-30] (IRONMACE Co., Ltd. -> IRONMACE Co., Ltd.)
S3 vgc; C:\Program Files\Riot Vanguard\vgc.exe [40075376 2025-05-05] (Riot Games, Inc. -> Riot Games, Inc.)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\NisSrv.exe [4538400 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25030.2-0\MsMpEng.exe [278320 2025-04-10] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 HnGService; D:\steam\steamapps\common\Heroes & Generals\hngservice.exe [X]

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 amsdk; C:\WINDOWS\system32\drivers\amsdk.sys [232792 2023-02-04] (Zemana D.O.O. Sarajevo -> Copyright 2018.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [282624 2023-08-11] (Microsoft Corporation) [File not signed]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [147968 2022-04-13] (Microsoft Corporation) [File not signed]
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [42256 2019-02-09] (AVB Disc Soft, SIA -> Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [59360 2019-02-09] (AVB Disc Soft, SIA -> Disc Soft Ltd)
S3 EasyAntiCheat_EOSSys; C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.sys [23515064 2025-04-23] (EasyAntiCheat Oy -> EasyAntiCheat Oy)
S3 Hamachi; C:\WINDOWS\System32\drivers\Hamdrv.sys [45680 2018-12-14] (Microsoft Windows Hardware Compatibility Publisher -> LogMeIn Inc.)
R3 hanvonugeemfilter; C:\WINDOWS\System32\drivers\hanvonugeemfilter.sys [9728 2023-07-28] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
R3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [331168 2025-04-10] (Microsoft Windows -> Microsoft Corporation)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [22120 2025-05-14] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
S3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239568 2024-08-19] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S3 mvusbews; C:\WINDOWS\System32\Drivers\mvusbews.sys [20480 2012-09-26] (Microsoft Windows Hardware Compatibility Publisher -> Marvell Semiconductor, Inc.)
S3 OCULUSUDSVR; C:\WINDOWS\System32\drivers\OCULUSUD.sys [3867552 2019-12-03] (Microsoft Windows Hardware Compatibility Publisher -> Oculus VR, LLC.)
R3 oculusvad_oculusvad; C:\WINDOWS\System32\drivers\oculusvad.sys [75280 2021-05-29] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
R3 Oculus_ViGEmBus; C:\WINDOWS\System32\drivers\Oculus_ViGEmBus.sys [32856 2019-12-03] (Oculus VR, LLC -> Facebook Inc.)
S3 qcusbnet; C:\WINDOWS\System32\drivers\qcusbnet.sys [428600 2017-03-15] (Microsoft Windows Hardware Compatibility Publisher -> QUALCOMM Incorporated)
S4 RsFx0500; C:\WINDOWS\System32\DRIVERS\RsFx0500.sys [261848 2017-08-22] (Microsoft Corporation -> Microsoft Corporation)
S3 RvNetMP60; C:\WINDOWS\System32\drivers\RvNetMP60.sys [58288 2023-07-10] (Microsoft Windows Hardware Compatibility Publisher -> Famatech Corp.)
R2 speedfan; C:\WINDOWS\SysWOW64\speedfan.sys [28664 2012-12-29] (SOKNO S.R.L. -> Almico Software)
R1 vgk; C:\Program Files\Riot Vanguard\vgk.sys [26955888 2025-05-05] (Riot Games, Inc. -> Riot Games, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [20016 2025-04-10] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [605576 2025-04-10] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [100744 2025-04-10] (Microsoft Windows -> Microsoft Corporation)
R3 wod0205; C:\WINDOWS\System32\drivers\wod0205.sys [33160 2011-04-23] (Secure Plus d.o.o. -> WeOnlyDo Software)
S3 xhunter1; C:\WINDOWS\xhunter1.sys [2719256 2020-03-22] (Wellbia.com Co., Ltd. -> Wellbia.com Co., Ltd.)
R3 XPPenTablet; C:\WINDOWS\System32\drivers\XPPenTablet.sys [10752 2024-09-09] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
S3 zttap300; C:\WINDOWS\System32\drivers\zttap300.sys [31744 2023-03-06] (Microsoft Windows Hardware Compatibility Publisher -> ZeroTier Networks LLC)
S3 EAAntiCheat; system32\drivers\eaanticheat.sys [X]
S4 NvModuleTracker; \SystemRoot\System32\DriverStore\FileRepository\nvmoduletracker.inf_amd64_ea6cec41fc5b2a8b\NvModuleTracker.sys [X]
S4 nvvhci; \SystemRoot\System32\drivers\nvvhci.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2025-05-20 21:22 - 2025-05-20 21:23 - 000036807 _____ C:\Users\david\Desktop\FRST.txt
2025-05-20 21:21 - 2025-05-20 21:23 - 000000000 ____D C:\FRST
2025-05-20 21:21 - 2025-05-20 21:21 - 002405888 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe
2025-05-20 20:39 - 2025-05-20 20:39 - 010134661 _____ C:\Users\david\Desktop\Tropy a figury - prezentace (zkrácená verze).pptx
2025-05-20 20:39 - 2025-05-20 20:39 - 004925446 _____ C:\Users\david\Desktop\Teorie literatury.pptx
2025-05-20 19:30 - 2025-05-20 19:30 - 000000202 _____ C:\Users\david\Desktop\Dead Island Definitive Edition.url
2025-05-20 18:54 - 2025-05-20 18:54 - 000006396 _____ C:\Users\david\Desktop\OLIVER TWIST.odt
2025-05-20 18:19 - 2025-05-20 18:19 - 000000000 ____D C:\Users\david\Desktop\příkladMP
2025-05-20 17:34 - 2025-05-20 17:34 - 000567129 _____ C:\Users\david\Downloads\otázka 4. + 12.zip
2025-05-19 18:34 - 2025-05-19 19:21 - 000000000 ____D C:\Users\david\AppData\Roaming\Star Stable Online
2025-05-19 17:37 - 2025-05-19 17:37 - 000000000 ____D C:\Users\david\AppData\Local\PeerDistRepub
2025-05-19 17:08 - 2025-05-19 17:08 - 000001425 _____ C:\Users\david\Desktop\příkladMP.zip
2025-05-19 17:07 - 2025-05-19 17:07 - 000567129 _____ C:\Users\david\Desktop\otázka 4. + 12.zip
2025-05-19 16:06 - 2025-05-19 16:06 - 000514096 _____ C:\Users\david\Desktop\Žák_4D_Ciselne_soustavy_v_IT.pptm
2025-05-19 15:52 - 2025-05-19 15:52 - 000776241 _____ C:\Users\david\Desktop\Prevody_Ciselnych_Soustav_Hanzl_4.D.pptx
2025-05-19 15:52 - 2025-05-19 15:52 - 000188572 _____ C:\Users\david\Desktop\Objektové programování – Novák.4.D.pptx
2025-05-19 14:46 - 2025-05-19 14:46 - 000000000 ____D C:\Users\david\AppData\Local\cache
2025-05-19 14:31 - 2025-05-20 20:04 - 000000000 ____D C:\Users\david\AppData\Roaming\discord
2025-05-19 14:30 - 2025-05-19 14:31 - 013922376 _____ (Zemana Ltd. ) C:\Users\david\Downloads\Zemana.AntiMalware.Setup.exe
2025-05-19 14:27 - 2025-05-19 14:27 - 000089874 _____ C:\Users\david\Desktop\zoek-results.txt
2025-05-19 14:25 - 2014-02-13 23:59 - 000024064 _____ C:\WINDOWS\zoek-delete.exe
2025-05-19 14:04 - 2025-05-19 14:22 - 000000000 ____D C:\zoek_backup
2025-05-19 14:03 - 2025-05-19 14:03 - 000009024 _____ C:\Users\david\Desktop\as_3597.tmp.txt
2025-05-18 18:26 - 2025-05-18 18:26 - 000823597 _____ C:\Users\david\Desktop\Databáze Syntaxe příkazů v SQL a Relační databáze.pptx
2025-05-18 02:18 - 2025-05-18 02:19 - 185115928 _____ (Sophos Limited) C:\Users\david\Desktop\Sophos Virus Removal Tool.exe
2025-05-18 02:00 - 2025-05-18 02:00 - 000004746 _____ C:\Users\david\Desktop\rogue.txt
2025-05-17 00:11 - 2025-05-17 00:11 - 000000999 _____ C:\Users\david\Desktop\JRT.txt
2025-05-15 17:20 - 2025-05-15 17:21 - 000000000 ____D C:\Users\david\AppData\Local\Star Stable
2025-05-15 16:48 - 2025-05-15 16:48 - 000000000 ____D C:\Users\david\AppData\Local\StarStableOnline
2025-05-15 16:46 - 2025-05-15 16:46 - 000001088 _____ C:\Users\Public\Desktop\Star Stable Online.lnk
2025-05-15 16:46 - 2025-05-15 16:46 - 000001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Star Stable Online.lnk
2025-05-15 16:46 - 2025-05-15 16:46 - 000000000 ____D C:\Users\david\AppData\Local\starstableonline-updater
2025-05-15 13:01 - 2025-05-15 13:01 - 000001237 _____ C:\Users\david\Desktop\Malwarebytes Scan Report 2025-05-15 105718.txt
2025-05-15 13:00 - 2025-05-15 16:49 - 000000000 ____D C:\Program Files\CrystalDiskInfo
2025-05-15 12:56 - 2025-05-15 12:56 - 000001483 _____ C:\Users\david\Desktop\AdwCleaner[S01].txt
2025-05-14 16:36 - 2025-05-14 16:36 - 000000203 _____ C:\Users\david\Desktop\In Sink A Co-Op Escape Prologue.url
2025-05-14 16:36 - 2025-05-14 16:36 - 000000000 ____D C:\Users\david\AppData\LocalLow\Clock Out Games
2025-05-14 16:04 - 2025-05-14 16:04 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UCP3-GUI
2025-05-14 16:04 - 2025-05-14 16:04 - 000000000 ____D C:\Users\david\AppData\Local\ucp.gui.tauri
2025-05-14 15:41 - 2025-05-14 15:41 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2025-05-14 15:36 - 2025-05-07 20:52 - 002072448 _____ C:\WINDOWS\system32\vulkaninfo-1-999-0-0-0.exe
2025-05-14 15:36 - 2025-05-07 20:52 - 002072448 _____ C:\WINDOWS\system32\vulkaninfo.exe
2025-05-14 15:36 - 2025-05-07 20:52 - 001614208 _____ C:\WINDOWS\SysWOW64\vulkaninfo-1-999-0-0-0.exe
2025-05-14 15:36 - 2025-05-07 20:52 - 001614208 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2025-05-14 15:36 - 2025-05-07 20:52 - 001576832 _____ C:\WINDOWS\system32\vulkan-1-999-0-0-0.dll
2025-05-14 15:36 - 2025-05-07 20:52 - 001576832 _____ C:\WINDOWS\system32\vulkan-1.dll
2025-05-14 15:36 - 2025-05-07 20:52 - 001389952 _____ C:\WINDOWS\SysWOW64\vulkan-1-999-0-0-0.dll
2025-05-14 15:36 - 2025-05-07 20:52 - 001389952 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2025-05-14 15:36 - 2025-05-07 20:52 - 000478368 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2025-05-14 15:36 - 2025-05-07 20:52 - 000374944 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2025-05-14 15:36 - 2025-05-07 20:49 - 005600464 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2025-05-14 15:36 - 2025-05-07 20:48 - 004901624 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2025-05-14 15:36 - 2025-05-07 20:48 - 001260192 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvml.dll
2025-05-14 15:36 - 2025-05-07 20:48 - 000674408 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvofapi64.dll
2025-05-14 15:36 - 2025-05-07 20:48 - 000508552 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvofapi.dll
2025-05-14 15:36 - 2025-05-07 20:47 - 026002048 _____ C:\WINDOWS\system32\nvidia-pcc.exe
2025-05-14 15:36 - 2025-05-07 20:47 - 002313328 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2025-05-14 15:36 - 2025-05-07 20:47 - 001713264 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2025-05-14 15:36 - 2025-05-07 20:47 - 001568880 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2025-05-14 15:36 - 2025-05-07 20:47 - 001220744 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2025-05-14 15:36 - 2025-05-07 20:47 - 001053824 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2025-05-14 15:36 - 2025-05-07 20:47 - 000941680 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvidia-smi.exe
2025-05-14 15:36 - 2025-05-07 20:47 - 000810112 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2025-05-14 15:36 - 2025-05-07 20:46 - 023035032 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2025-05-14 15:36 - 2025-05-07 20:46 - 020517000 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2025-05-14 15:36 - 2025-05-07 20:46 - 007323264 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2025-05-14 15:36 - 2025-05-07 20:46 - 005240480 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcudadebugger.dll
2025-05-14 15:36 - 2025-05-07 20:46 - 003994240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2025-05-14 15:36 - 2025-05-07 20:46 - 000467056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdebugdump.exe
2025-05-14 15:36 - 2025-05-07 20:45 - 005914240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2025-05-14 15:36 - 2025-05-07 20:45 - 000853632 _____ (NVIDIA Corporation) C:\WINDOWS\system32\MCU.exe
2025-05-14 15:36 - 2025-05-07 02:12 - 000143016 _____ C:\WINDOWS\system32\nvinfo.pb
2025-05-14 13:35 - 2025-05-14 13:35 - 000000000 ____D C:\Users\david\Documents\Battlefield 1
2025-05-14 12:32 - 2025-05-14 14:16 - 000000000 ____D C:\ProgramData\Packer
2025-05-14 12:31 - 2025-05-14 12:31 - 000000000 ____D C:\Users\david\AppData\Roaming\EAAntiCheat.Installer.Tool
2025-05-14 12:31 - 2025-05-14 12:31 - 000000000 ____D C:\Users\david\AppData\Roaming\EA
2025-05-14 12:31 - 2025-05-14 12:31 - 000000000 ____D C:\ProgramData\eaanticheat
2025-05-14 12:31 - 2025-05-14 12:31 - 000000000 ____D C:\Program Files\EA
2025-05-14 06:45 - 2025-05-14 06:45 - 000022680 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2025-05-14 06:45 - 2025-05-14 06:45 - 000022680 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2025-05-14 06:38 - 2025-05-14 06:38 - 000000000 ___HD C:\$WinREAgent
2025-05-13 23:39 - 2025-05-13 23:39 - 000000203 _____ C:\Users\david\Desktop\Battlefield™ 1.url
2025-05-09 14:22 - 2025-05-09 14:22 - 000000000 ____D C:\Users\david\AppData\LocalLow\semiwork
2025-05-08 01:07 - 2025-05-08 01:07 - 000000203 _____ C:\Users\david\Desktop\R.E.P.O..url
2025-05-05 23:28 - 2025-05-05 23:28 - 000000000 ____D C:\Users\david\AppData\Roaming\BioshockHD
2025-05-03 17:19 - 2025-05-03 17:19 - 000000000 ____D C:\Users\david\AppData\Roaming\RenPy
2025-05-03 15:00 - 2025-05-03 15:00 - 003565706 _____ C:\Users\david\Desktop\czhoi4_11605.zip
2025-05-01 18:25 - 2025-05-19 14:22 - 000000000 ____D C:\Users\david\Desktop\lewd house překlad
2025-04-28 19:01 - 2025-04-28 19:01 - 000114352 _____ (GameRanger Technologies) C:\Users\david\Downloads\gameranger-4.9-installer.exe
2025-04-28 17:46 - 2025-04-28 17:46 - 000000000 ____D C:\Users\david\AppData\Local\ZeroTier
2025-04-28 17:46 - 2025-04-28 17:46 - 000000000 ____D C:\ProgramData\ZeroTier
2025-04-28 17:46 - 2025-04-28 17:46 - 000000000 ____D C:\Program Files (x86)\ZeroTier
2025-04-28 00:04 - 2025-04-28 00:04 - 001823515 _____ ( ) C:\Users\david\Downloads\T3AOnlineBFME1_Patch1.06_AIO (1).exe
2025-04-27 23:16 - 2025-04-27 23:16 - 000000000 ____D C:\Users\david\AppData\Roaming\Portforward.com
2025-04-27 20:40 - 2025-04-27 20:40 - 001823515 _____ ( ) C:\Users\david\Downloads\T3AOnlineBFME1_Patch1.06_AIO.exe
2025-04-27 20:38 - 2025-04-27 20:38 - 002592768 _____ C:\Users\david\Desktop\t3aonline_2.1.3.msi
2025-04-24 16:51 - 2025-04-24 16:51 - 000000635 _____ C:\Users\david\Desktop\Enlisted.lnk
2025-04-24 16:51 - 2025-04-24 16:51 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Enlisted
2025-04-24 14:54 - 2025-04-24 14:55 - 000000553 _____ C:\Users\david\Desktop\Bubble sort- Hronovský.py
2025-04-24 14:33 - 2025-04-24 14:40 - 000001579 _____ C:\Users\david\Python- Hronovský.py
2025-04-24 14:16 - 2025-04-24 14:16 - 000000202 _____ C:\Users\david\Desktop\BioShock Remastered.url
2025-04-23 20:36 - 2025-04-23 20:36 - 000000200 _____ C:\Users\david\Desktop\FlatOut 2.url

N0váček
Level 2
Level 2
Příspěvky: 165
Registrován: prosinec 14
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod N0váček » 20 kvě 2025 21:28

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2025-05-20 21:23 - 2024-12-06 10:21 - 008602473 _____ C:\WINDOWS\ZAM.krnl.trace
2025-05-20 21:19 - 2020-09-18 01:13 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2025-05-20 21:19 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2025-05-20 21:03 - 2024-04-12 13:47 - 000000000 ____D C:\Users\david\AppData\Local\Discord
2025-05-20 21:00 - 2025-02-23 16:15 - 000003200 _____ C:\WINDOWS\system32\Tasks\AdobeCreativeCloud_ScheduleUpdates
2025-05-20 20:48 - 2018-07-12 19:34 - 000000000 ____D C:\Users\david\AppData\Local\Packages
2025-05-20 18:22 - 2018-10-22 16:30 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\Word
2025-05-20 17:12 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2025-05-20 17:12 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2025-05-20 17:10 - 2020-09-18 01:21 - 000005264 _____ C:\WINDOWS\system32\Tasks\Microsoft Office 15 Sync Maintenance for DESKTOP-OKDVTKV-david DESKTOP-OKDVTKV
2025-05-20 16:50 - 2023-09-16 16:37 - 000000000 ____D C:\ProgramData\EA Desktop
2025-05-20 15:12 - 2021-09-15 15:36 - 000000000 ___HD C:\Users\Public\Documents\AdobeGCData
2025-05-20 15:08 - 2018-10-22 16:27 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2025-05-20 15:06 - 2025-01-14 22:37 - 000003576 _____ C:\WINDOWS\system32\Tasks\OneDrive Startup Task-S-1-5-21-2321539691-1916493358-1505984254-1001
2025-05-20 15:06 - 2021-12-19 00:17 - 000000000 ____D C:\WINDOWS\SystemTemp
2025-05-20 15:06 - 2021-12-13 21:44 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-2321539691-1916493358-1505984254-1001
2025-05-20 15:06 - 2020-09-18 01:21 - 000003380 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2321539691-1916493358-1505984254-1001
2025-05-20 15:06 - 2020-09-18 01:14 - 000002426 _____ C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2025-05-20 15:05 - 2023-05-13 10:12 - 000003326 _____ C:\WINDOWS\system32\Tasks\CCleanerCrashReporting
2025-05-20 15:05 - 2023-05-13 10:12 - 000000670 _____ C:\WINDOWS\Tasks\CCleanerCrashReporting.job
2025-05-20 15:02 - 2022-02-20 01:37 - 000000000 ____D C:\Users\david\AppData\Local\AMSDK
2025-05-20 15:02 - 2020-09-18 01:21 - 000003640 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2025-05-20 15:02 - 2020-09-18 01:21 - 000003514 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2025-05-20 15:02 - 2019-12-03 19:09 - 000000000 ____D C:\Users\david\AppData\Local\Oculus
2025-05-19 22:37 - 2018-07-12 19:32 - 000000000 ____D C:\ProgramData\NVIDIA
2025-05-19 17:38 - 2018-07-16 18:42 - 000000000 ____D C:\Users\david\AppData\Local\D3DSCache
2025-05-19 16:57 - 2021-10-21 17:50 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\PowerPoint
2025-05-19 14:37 - 2023-02-04 12:51 - 000003558 _____ C:\WINDOWS\system32\Tasks\AMHelper
2025-05-19 14:37 - 2023-02-04 12:51 - 000001333 _____ C:\Users\Public\Desktop\Zemana AntiMalware.lnk
2025-05-19 14:37 - 2023-02-04 12:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
2025-05-19 14:34 - 2020-09-18 01:23 - 002022462 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2025-05-19 14:34 - 2019-12-07 16:43 - 000831674 _____ C:\WINDOWS\system32\perfh005.dat
2025-05-19 14:34 - 2019-12-07 16:43 - 000191416 _____ C:\WINDOWS\system32\perfc005.dat
2025-05-19 14:34 - 2019-12-07 11:13 - 000000000 ____D C:\WINDOWS\INF
2025-05-19 14:30 - 2024-05-05 20:50 - 000000001 _____ C:\WINDOWS\vgkbootstatus.dat
2025-05-19 14:29 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2025-05-19 14:28 - 2023-10-21 10:34 - 000000000 ____D C:\Users\david\AppData\Local\Malwarebytes
2025-05-19 14:27 - 2020-09-18 01:21 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2025-05-19 14:27 - 2020-09-18 01:13 - 000697120 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2025-05-19 14:27 - 2020-09-18 01:13 - 000008192 ___SH C:\DumpStack.log.tmp
2025-05-19 14:26 - 2019-12-07 11:03 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2025-05-19 14:05 - 2018-07-13 17:00 - 000000000 ____D C:\Users\david\AppData\Local\CrashDumps
2025-05-19 01:31 - 2024-12-07 16:56 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Visual Studio Code
2025-05-18 19:08 - 2025-04-05 14:17 - 000000000 ____D C:\Users\david\Desktop\maturitní otázky
2025-05-18 19:01 - 2021-10-16 12:47 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\Excel
2025-05-18 14:59 - 2024-09-17 21:55 - 134222904 _____ C:\WINDOWS\392667600.dat
2025-05-18 14:33 - 2024-03-07 22:26 - 000000000 ____D C:\Users\david\AppData\Roaming\riot-client-ux
2025-05-18 14:33 - 2018-08-05 12:27 - 000000000 ____D C:\ProgramData\Riot Games
2025-05-18 02:46 - 2021-10-16 13:56 - 000000000 ____D C:\Program Files (x86)\Windows Kits
2025-05-18 02:46 - 2021-10-16 13:48 - 000000000 ____D C:\Program Files (x86)\Microsoft Visual Studio
2025-05-18 02:46 - 2020-09-18 02:04 - 000000000 ____D C:\Program Files (x86)\MSBuild
2025-05-18 02:46 - 2019-12-07 11:14 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2025-05-18 02:45 - 2022-06-03 18:15 - 000000000 ____D C:\Program Files (x86)\dotnet
2025-05-18 02:43 - 2021-10-16 14:14 - 000000000 ____D C:\WINDOWS\SysWOW64\1033
2025-05-18 02:43 - 2021-10-16 14:14 - 000000000 ____D C:\WINDOWS\system32\1033
2025-05-18 02:38 - 2021-10-16 15:00 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\VisualStudio
2025-05-18 02:29 - 2021-09-15 15:36 - 000000000 ____D C:\Program Files\Common Files\Adobe
2025-05-18 02:29 - 2021-09-15 15:36 - 000000000 ____D C:\Program Files\Adobe
2025-05-18 02:29 - 2021-09-15 15:33 - 000000000 ____D C:\Users\david\AppData\Local\Adobe
2025-05-17 19:20 - 2018-12-24 20:36 - 000000000 ____D C:\Program Files\CCleaner
2025-05-17 13:19 - 2020-06-06 13:58 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2025-05-17 13:19 - 2020-06-06 13:58 - 000002274 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2025-05-15 22:17 - 2019-01-19 13:09 - 000002301 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2025-05-15 22:17 - 2019-01-19 13:09 - 000002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2025-05-15 13:00 - 2020-08-13 17:54 - 000001828 _____ C:\Users\david\Desktop\CrystalDiskInfo.lnk
2025-05-15 13:00 - 2020-08-13 17:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2025-05-15 12:46 - 2018-08-22 17:34 - 000000000 ____D C:\Users\david\AppData\Local\NVIDIA
2025-05-14 15:48 - 2018-07-13 17:00 - 000000000 ____D C:\Users\david\AppData\Roaming\uTorrent
2025-05-14 13:12 - 2024-11-15 00:57 - 000003834 _____ C:\WINDOWS\system32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2025-05-14 13:12 - 2018-07-12 19:32 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2025-05-14 12:53 - 2020-09-18 01:21 - 000004210 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2025-05-14 12:49 - 2023-01-31 21:12 - 000022120 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamElam.sys
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ___RD C:\WINDOWS\PrintDialog
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SystemResources
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\setup
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\ShellExperiences
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\ShellComponents
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2025-05-14 12:38 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2025-05-14 12:38 - 2019-12-07 11:03 - 000000000 ____D C:\WINDOWS\servicing
2025-05-14 06:48 - 2019-12-07 11:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2025-05-14 06:45 - 2020-09-18 01:19 - 003016192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2025-05-14 06:26 - 2018-07-12 22:13 - 000000000 ____D C:\WINDOWS\system32\MRT
2025-05-14 06:22 - 2018-07-12 22:13 - 214836568 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2025-05-13 14:55 - 2021-09-15 15:40 - 000000000 ___RD C:\Users\david\Creative Cloud Files Company Account EDUCA Pardubice - Stredni odborna skola david.hronovsky@educapardubice.cz DA6C0BA062ABA8EE0A495FB6@d8c4476362aba8ea495e17.e
2025-05-13 14:55 - 2020-09-18 01:14 - 000000000 ____D C:\Users\david
2025-05-11 13:03 - 2024-05-05 20:47 - 000000000 ____D C:\Program Files\Riot Vanguard
2025-05-09 15:23 - 2024-01-20 15:23 - 000000000 ____D C:\Program Files (x86)\Overwolf
2025-05-06 17:37 - 2020-10-29 17:38 - 000271392 _____ C:\WINDOWS\system32\FvSDK_x64.dll
2025-05-06 17:37 - 2020-10-29 17:38 - 000245792 _____ C:\WINDOWS\SysWOW64\FvSDK_x86.dll
2025-05-06 17:36 - 2024-11-15 00:57 - 003114016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2025-05-06 17:36 - 2024-11-15 00:57 - 002403360 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2025-05-06 17:09 - 2018-09-03 17:59 - 000180760 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2025-05-06 17:09 - 2018-09-03 17:59 - 000159768 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2025-05-06 17:08 - 2021-06-23 21:49 - 000001951 _____ C:\WINDOWS\NvContainerRecovery.bat
2025-05-02 10:36 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\NDF
2025-04-30 01:20 - 2021-09-15 16:24 - 000004562 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2025-04-30 01:18 - 2022-10-11 13:37 - 000001701 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller.lnk
2025-04-30 01:18 - 2022-10-11 13:37 - 000001692 _____ C:\Users\Public\Desktop\Adobe Acrobat.lnk
2025-04-30 01:18 - 2022-10-11 13:37 - 000001692 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk
2025-04-29 15:17 - 2023-10-25 19:34 - 000001281 _____ C:\Users\david\Desktop\PLITCH.lnk
2025-04-29 15:17 - 2023-10-25 19:34 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PLITCH
2025-04-28 19:15 - 2024-09-21 19:49 - 000000000 ____D C:\Users\david\AppData\Roaming\GameRanger
2025-04-28 17:25 - 2024-12-04 23:47 - 000000000 ____D C:\Users\david\AppData\Roaming\My Battle for Middle-earth(tm) II Files
2025-04-28 14:12 - 2021-10-16 11:33 - 000000000 ____D C:\Users\david\AppData\LocalLow\Adobe
2025-04-28 00:10 - 2022-06-24 08:31 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\T3AOnline
2025-04-28 00:09 - 2022-06-24 08:31 - 000002881 _____ C:\Users\david\Desktop\T3A Online.lnk
2025-04-27 03:22 - 2024-03-07 19:32 - 000000000 ____D C:\Users\david\AppData\Local\SDLauncher
2025-04-24 16:51 - 2018-07-14 13:51 - 000000000 ____D C:\Users\david\Documents\My Games
2025-04-23 20:08 - 2024-08-13 19:36 - 000000000 ____D C:\Users\david\AppData\Roaming\EasyAntiCheat
2025-04-23 19:00 - 2025-03-17 23:34 - 000000000 ____D C:\Users\david\AppData\Roaming\WeMod
2025-04-23 18:52 - 2022-10-13 22:12 - 000000000 ____D C:\Program Files (x86)\EasyAntiCheat_EOS
2025-04-23 16:23 - 2025-03-17 23:34 - 000002250 _____ C:\Users\david\Desktop\WeMod.lnk
2025-04-23 16:23 - 2025-03-17 23:34 - 000000000 ____D C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WeMod
2025-04-23 16:23 - 2025-03-17 23:34 - 000000000 ____D C:\Users\david\AppData\Local\WeMod
2025-04-23 16:23 - 2018-12-02 00:49 - 000000000 ____D C:\Users\david\AppData\Local\SquirrelTemp
2025-04-22 22:57 - 2018-12-30 19:23 - 000000000 ____D C:\Users\david\AppData\Local\Frontier Developments
2025-04-22 22:57 - 2018-12-30 19:23 - 000000000 ____D C:\ProgramData\Frontier Developments
2025-04-21 23:20 - 2025-03-15 20:46 - 000378432 _____ (Microsoft Corporation) C:\WINDOWS\system32\gamingservicesproxy_8.dll
2025-04-21 23:20 - 2022-10-20 14:50 - 000124480 _____ (Microsoft Corporation) C:\WINDOWS\system32\xgamehelper.exe
2025-04-21 23:20 - 2022-10-20 14:50 - 000075304 _____ (Microsoft Corporation) C:\WINDOWS\system32\xgamecontrol.exe
2025-04-21 23:20 - 2022-02-09 17:59 - 002901544 _____ (Microsoft Corporation) C:\WINDOWS\system32\xgameruntime.dll
2025-04-21 23:20 - 2022-02-09 17:59 - 000796224 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameplatformservices.dll
2025-04-21 23:20 - 2022-02-09 17:59 - 000267840 _____ (Microsoft Corporation) C:\WINDOWS\system32\gamelaunchhelper.dll
2025-04-21 23:20 - 2022-02-09 17:59 - 000243240 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameconfighelper.dll
2025-04-21 23:20 - 2022-02-09 17:59 - 000153152 _____ (Microsoft Corporation) C:\WINDOWS\system32\gamingtcuihelpers.dll

==================== Files in the root of some directories ========

2025-01-10 14:36 - 2025-03-09 02:05 - 000029987 _____ () C:\Users\david\AppData\Local\kritarc.backup
2025-05-20 15:12 - 2025-05-20 15:12 - 000000000 _____ () C:\Users\david\AppData\Local\oobelibMkey.log
2025-01-12 22:10 - 2025-01-12 22:10 - 000001314 _____ () C:\Users\david\AppData\Local\recently-used.xbel
2025-03-06 14:23 - 2025-03-06 14:23 - 000005026 _____ () C:\Users\david\AppData\Local\user-places.xbel
2025-03-04 01:59 - 2025-03-04 01:59 - 000004745 _____ () C:\Users\david\AppData\Local\user-places.xbel.bak
2025-03-06 14:23 - 2025-03-06 14:23 - 000000000 _____ () C:\Users\david\AppData\Local\user-places.xbel.tbcache

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43287
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod jaro3 » 20 kvě 2025 22:54

Prosím, postupuj následujícím způsobem:
Otevřít poznámkový blok (Start => Všechny programy => Příslušenství => Poznámkový blok).
Prosím, zkopíruj do něj celý obsah níže.

Kód: Vybrat vše

Start
CreateRestorePoint:
CloseProcesses:
CustomCLSID: HKU\S-1-5-21-2321539691-1916493358-1505984254-1001_Classes\CLSID\{14100442-9664-1407-2647-000000000000}\localserver32 -> "C:\Users\david\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe" -ToastActivated => No File
AlternateDataStreams: C:\ProgramData\DP45977C.lfl:677104FCAA [3442]
AlternateDataStreams: C:\ProgramData\DP45977C.lfl:677104FCAA [3442]
AlternateDataStreams: C:\ProgramData\goyslgxe.nnn:7297ACA992 [3442]
AlternateDataStreams: C:\ProgramData\lzmiudcz.flf:B96BCC688C [3442]
AlternateDataStreams: C:\ProgramData\settings.ini:27EB0451C1 [3442]
AlternateDataStreams: C:\ProgramData\settings.ini:5B48B5BC13 [3442]
AlternateDataStreams: C:\ProgramData\wobcpcvn.rxt:597BC1DFF5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\Users\david\Data aplikací:fc7b7d0f14c2a9475ac28a6ca7e82bc5 [394]
AlternateDataStreams: C:\Users\david\AppData\Roaming:fc7b7d0f14c2a9475ac28a6ca7e82bc5 [394]
AlternateDataStreams: C:\Users\david\AppData\Local\Microsoft:ISBD [32]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [464]
AlternateDataStreams: C:\Users\Public\Documents\settings.ini:ABCC4E1BB3 [3442]
BHO: No Name -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> No File
C:\Windows\System32\drivers\truesight.sys
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (No File)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [ZeroTierUI] => C:\Program Files (x86)\ZeroTier\One\zerotier_desktop_ui.exe (No File)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\RunOnce: [Uninstall 25.065.0406.0002] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\david\AppData\Local\Microsoft\OneDrive\25.065.0406.0002" [0 2025-05-20] () <==== ATTENTION [zero byte File/Folder]
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\MountPoints2: {a63fa35f-2b15-11e9-ae21-7085c27f60c4} - "F:\AutoRun.exe"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\MountPoints2: {e74685d5-bef7-11ec-aee5-7085c27f60c4} - "G:\SISetup.exe"
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {ABF2C9C8-9494-414B-8C8F-989AAAA72E40} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem138.0.7156.0{8AE088AA-8597-4733-A646-C67434DEF469} => C:\Program Files (x86)\Google\GoogleUpdater\138.0.7156.0\updater.exe [7096416 2025-05-02] (Google LLC -> Google LLC)
CHR HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
C:\Users\david\AppData\Local\AMSDK\Quarantine\3FF5A15752C1A96348EAA20D1A6C77A3\file\FILE:0000\FILE:0000
C:\Users\david\AppData\Local\AMSDK\Quarantine\3FF5A15752C1A96348EAA20D1A6C77A3\file\FILE:0000

EmptyTemp:
End

(Můžeš použít funkci „vybrat vše“, klepni pravým tlačítkem myši na levé horní políčko v otevřeném poznámkovém bloku a zvol „ Vložit“).

Ulož jej na na plochu jako fixlist.txt


Spusťt FRST a stiskni tlačítko „Fix“ (Opravit) jen jednou a čekej.
Nástroj vypracuje log na ploše (Fixlog.txt), prosím zkopíruj sem celý jeho obsah.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

N0váček
Level 2
Level 2
Příspěvky: 165
Registrován: prosinec 14
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod N0váček » 21 kvě 2025 14:30

Fix result of Farbar Recovery Scan Tool (x64) Version: 18-05-2025
Ran by david (21-05-2025 14:26:20) Run:1
Running from C:\Users\david\Desktop
Loaded Profiles: david & SQLTELEMETRY$DUEL
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
CustomCLSID: HKU\S-1-5-21-2321539691-1916493358-1505984254-1001_Classes\CLSID\{14100442-9664-1407-2647-000000000000}\localserver32 -> "C:\Users\david\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe" -ToastActivated => No File
AlternateDataStreams: C:\ProgramData\DP45977C.lfl:677104FCAA [3442]
AlternateDataStreams: C:\ProgramData\DP45977C.lfl:677104FCAA [3442]
AlternateDataStreams: C:\ProgramData\goyslgxe.nnn:7297ACA992 [3442]
AlternateDataStreams: C:\ProgramData\lzmiudcz.flf:B96BCC688C [3442]
AlternateDataStreams: C:\ProgramData\settings.ini:27EB0451C1 [3442]
AlternateDataStreams: C:\ProgramData\settings.ini:5B48B5BC13 [3442]
AlternateDataStreams: C:\ProgramData\wobcpcvn.rxt:597BC1DFF5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\Users\david\Data aplikací:fc7b7d0f14c2a9475ac28a6ca7e82bc5 [394]
AlternateDataStreams: C:\Users\david\AppData\Roaming:fc7b7d0f14c2a9475ac28a6ca7e82bc5 [394]
AlternateDataStreams: C:\Users\david\AppData\Local\Microsoft:ISBD [32]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [464]
AlternateDataStreams: C:\Users\Public\Documents\settings.ini:ABCC4E1BB3 [3442]
BHO: No Name -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> No File
C:\Windows\System32\drivers\truesight.sys
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (No File)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\Run: [ZeroTierUI] => C:\Program Files (x86)\ZeroTier\One\zerotier_desktop_ui.exe (No File)
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\RunOnce: [Uninstall 25.065.0406.0002] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\david\AppData\Local\Microsoft\OneDrive\25.065.0406.0002" [0 2025-05-20] () <==== ATTENTION [zero byte File/Folder]
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\MountPoints2: {a63fa35f-2b15-11e9-ae21-7085c27f60c4} - "F:\AutoRun.exe"
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\...\MountPoints2: {e74685d5-bef7-11ec-aee5-7085c27f60c4} - "G:\SISetup.exe"
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {ABF2C9C8-9494-414B-8C8F-989AAAA72E40} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem138.0.7156.0{8AE088AA-8597-4733-A646-C67434DEF469} => C:\Program Files (x86)\Google\GoogleUpdater\138.0.7156.0\updater.exe [7096416 2025-05-02] (Google LLC -> Google LLC)
CHR HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
C:\Users\david\AppData\Local\AMSDK\Quarantine\3FF5A15752C1A96348EAA20D1A6C77A3\file\FILE:0000\FILE:0000
C:\Users\david\AppData\Local\AMSDK\Quarantine\3FF5A15752C1A96348EAA20D1A6C77A3\file\FILE:0000

EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001_Classes\CLSID\{14100442-9664-1407-2647-000000000000} => removed successfully
C:\ProgramData\DP45977C.lfl => ":677104FCAA" ADS removed successfully
"C:\ProgramData\DP45977C.lfl" => ":677104FCAA" ADS not found.
C:\ProgramData\goyslgxe.nnn => ":7297ACA992" ADS removed successfully
C:\ProgramData\lzmiudcz.flf => ":B96BCC688C" ADS removed successfully
C:\ProgramData\settings.ini => ":27EB0451C1" ADS removed successfully
C:\ProgramData\settings.ini => ":5B48B5BC13" ADS removed successfully
C:\ProgramData\wobcpcvn.rxt => ":597BC1DFF5" ADS removed successfully
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini => ":B1DA6C571C" ADS removed successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk => ":A1B76439FE" ADS removed successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk => ":B96E9B8455" ADS removed successfully
C:\Users\david\Data aplikací => ":fc7b7d0f14c2a9475ac28a6ca7e82bc5" ADS removed successfully
"C:\Users\david\AppData\Roaming" => ":fc7b7d0f14c2a9475ac28a6ca7e82bc5" ADS not found.
C:\Users\david\AppData\Local\Microsoft => ":ISBD" ADS removed successfully
C:\Users\Public\Shared Files => ":VersionCache" ADS removed successfully
C:\Users\Public\Documents\settings.ini => ":ABCC4E1BB3" ADS removed successfully
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} => removed successfully
HKLM\Software\Classes\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF} => removed successfully
"C:\Windows\System32\drivers\truesight.sys" => not found
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Wondershare Helper Compact.exe" => removed successfully
"HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ZeroTierUI" => removed successfully
"HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Uninstall 25.065.0406.0002" => not found
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a63fa35f-2b15-11e9-ae21-7085c27f60c4} => removed successfully
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e74685d5-bef7-11ec-aee5-7085c27f60c4} => removed successfully
HKLM\SOFTWARE\Policies\Mozilla => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{ABF2C9C8-9494-414B-8C8F-989AAAA72E40}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ABF2C9C8-9494-414B-8C8F-989AAAA72E40}" => removed successfully
C:\WINDOWS\System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem138.0.7156.0{8AE088AA-8597-4733-A646-C67434DEF469} => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem138.0.7156.0{8AE088AA-8597-4733-A646-C67434DEF469}" => removed successfully
HKU\S-1-5-21-2321539691-1916493358-1505984254-1001\SOFTWARE\Google\Chrome\Extensions\efaidnbmnnnibpcajpcglclefindmkaj => removed successfully
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\efaidnbmnnnibpcajpcglclefindmkaj => removed successfully
"C:\Users\david\AppData\Local\AMSDK\Quarantine\3FF5A15752C1A96348EAA20D1A6C77A3\file\FILE:0000\FILE:0000" => not found
"C:\Users\david\AppData\Local\AMSDK\Quarantine\3FF5A15752C1A96348EAA20D1A6C77A3\file\FILE:0000" => not found

=========== EmptyTemp: ==========

FlushDNS => completed
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 35326782 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 652842581 B
Windows/system/drivers => 5840994 B
Edge => 0 B
Chrome => 1254983011 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 3498 B
david => 239236129 B
defaultuser100000 => 239236129 B
OVRLibraryService => 239236129 B
SQLTELEMETRY$DUEL => 239236129 B

RecycleBin => 4252109 B
EmptyTemp: => 2.7 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 14:27:57 ====

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43287
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Kontrola logu - pc pořád hlásí virus, i po odstranění zavirovaného souboru

Příspěvekod jaro3 » 21 kvě 2025 15:28

Co problémy?
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra


Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 98 hostů